communication between vlan
-
yes indeed on the graphical interface I see this clearly but as I showed you this is what is there on the graphical interface and which corresponds to the result that I sent previously.
I receive dozens of packets every second in this state even though no ping is in progress
-
@Nimizu said in communication between vlan:
I receive dozens of packets every second in this state even though no ping is in progress
Again you are not receiving those, that is the monitoring that pfsense does where it send 1 ping every half second. You must of setup your monitoring to use 8.8.8.8 vs your actual default gateway.. You can clearly see the destination is 8.8.8.8 so its the dpinger service doing its monitoring.
-
Start a ping from some client on one of the internal VLANs to 1.1.1.1.
Then look for the states created in the GUI and at the CLI like you just did.
-
-
@Nimizu so something wrong with the gui not showing the states.. But something odd.. is looks like that output shows ALL for the interface?
Which maybe explains why gui not showing them???
Notice mine shows igb0 and igb1 my lan and wan interfaces.. Not sure why your output shows all vs some specific interface.
-
Because 24.03 switched (back) to interface bound states as default. In 2.7.2 and 23.09 states are floating on 'all' interfaces. So that looks correct.
You should see those states in the GUI if you filter that by
1.1.1.1also.That traffic is passing through the firewall and should be blockable.
-
let's go. I finally see on the GUI.
I now tried to ping a client that is in another vlan and I got this result:
So I tried to make the blocking rules and when I do the following rule this blocks the ping :
thank you very much for your help but I don't understand everything because I just reactivated the rules that I had already made and now it works and before it didn't work.
But the importance and that now it works. THANKS
-
@Nimizu think we went down a deep rabbit whole there on the states not being in the gui.. You were filtering?
Once a state is created the state allows, so if you test something and then try to block it - you have to make sure you either kill that state or wait for it to timeout or close on its own. Before your rule will work.
-
Mmm, I'm not sure what happened there. It seems like either the traffic was bypassing the firewall entirely and now isn't for some reason. Or we were just not looking correctly.
-
I didn't put any filter or just icmp and I didn't see anything but the end result is that it works. I'm going to test on other firewalls to see if I encounter the same problem.
But it works, thank you.
-
Hmm, something must have changed. If nothing changed in the firewall/switch it must have been in a client somehow.
