PLEASE stop enforcing firewall rules on pfsense!!! Let us manage our own firewall rules!!!

denitrosubmena

@MoonKnight said in PLEASE stop enforcing firewall rules on pfsense!!! Let us manage our own firewall rules!!!:

@denitrosubmena

Just make an allow rule for your local computer to access your pfsense WAN IP.

i can access web UI via WAN address now but new issue is vms not able to get LAN ip from dhcp server

and when i did set the static ipv4 ip on the vm, i can not reach the internet and i can not even ping the pfsense gateway address for the LAN interface

so am stuck here wondering what else is going on here

before fixing the web UI access on WAN i was able to get LAN ip from dhcp and ping internet fine but now i cant

johnpoz

@denitrosubmena your wan rules have zero to do with dhcp on your lan.. when you try and ping the pfsense IP on the lan from some device on your lan.. Look in its arp table - do you see the mac address of pfsense.. If not then they are not on the same L2 network, if not then that would explain why your not getting dhcp.

What rules do you have on your lan? What rules would have nothing to do with if the device on lan can see the mac address of pfsense lan interface.

Maybe you didn't put in the dhcp rules? hahha just kidding, pfsense auto puts in those rules for you.. But maybe they should stop doing that because you know.. Let you manage your own firewall rules ;)

denitrosubmena

@johnpoz

here is rules on LAN

so i restarted pfsense and also restarted the VM

so i can see the static ip address of the VM 10.100.0.1 but it is showing lease time as if it is DHCP lease but it is not and nothing shows up under DHCP lease either so am not sure why it has the expire time

i still cant ping or connect to the internet from the VM and i cant ping the gateway address of the LAN subnet 10.100.255.254 from the VM 10.100.0.1

so am not sure what is going on here and i remembered i could ping the internet before i fixed the previous issue of not being able to access the web UI from WAN ip when LAN is added to pfsense but i can no longer do it

if you need any other info else let me know

johnpoz

@denitrosubmena that is not a lease, that is your arp cache..

Where is on your lab2 box its arp cache? do an arp -a.. Do you see pfsense lan mac?

Validate this is the correct mac if you see it.. Seems like pfsense can see the mac of 0.1

Where is your ping to just pfsense IP 10.10.255.254?

You plan on having a shit ton of clients I see with a /16 mask = 65k clients?? ;)

You have the same /16 mask on pfsense lan.. Many a user make a mistake and have it on /32 because that is what the drop down defaults too, etc.

denitrosubmena

@johnpoz

here is screenshot with more commands, it simply cant connect to the internet and i cant ping the LAN gateway so that explains it

I have no idea how this is happening

yes LAN is 10.100.0.0/16 it is lab as name suggests so yeah wanted to test with that large subnet

johnpoz

@denitrosubmena well if you can not even ping the gateway and your rules allow for ping, which they do - then no your not going to get to the internet..

Why would think you could update with apt if you can not even ping your gateway?

denitrosubmena

@johnpoz

well i just tried all that so i can show you what am facing
i know if i cant ping gateway i cant reach internet, i know but just wanted to show what is going on

So any way out of this?

johnpoz

@denitrosubmena well since your error is just timeout with your ping from your client.. that points to it seeing a mac for that IP.. Is it the right one? can't tell without viewing your arp table.

so if a client doesn't know the mac address of an ip your trying to ping you would normally see an error like so

linux

user@UC:~$ ping 192.168.2.66
PING 192.168.2.66 (192.168.2.66) 56(84) bytes of data.
From 192.168.2.13 icmp_seq=1 Destination Host Unreachable
From 192.168.2.13 icmp_seq=5 Destination Host Unreachable
From 192.168.2.13 icmp_seq=8 Destination Host Unreachable

windows

$ ping 192.168.9.44

Pinging 192.168.9.44 with 32 bytes of data:
Reply from 192.168.9.100: Destination host unreachable.
Reply from 192.168.9.100: Destination host unreachable.

Ping statistics for 192.168.9.44:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

As to what is going on with your setup I not sure.. Is this real hardware, all on a vm - some hardware and vm?

When you ping from the client to pfsense lan IP while sniffing on pfsense lan interface - do you see those pings?

When you were messing around with rules - did you happen to put some rule in the floating tab that could be blocking. But that wouldn't stop dhcp since when you enable dhcp, pfsense puts in hidden rules above where floating rules that allows for dhcp..

Your wan IP (via dhcp?) not overlapping with the /16 you put on the lan is it?

denitrosubmena

@johnpoz

here is packet capture when i ran ping from the VM to pfsense LAN gateway

pfsense is VM in proxmox and then VM 10.100.0.1 will use pfsense as router

denitrosubmena

@johnpoz

I fixed the issue!!!
stupid me, so i turned on firewall on the pfsense VM in proxmox which was blocking everything

I turned off the firewall and now am good, VM is working fine and can reach internet

what a day

thanks for all your help

johnpoz

@denitrosubmena I was going to say you see the arp and the reply.. so that screams firewall between somewhere, be it on the client or something between. If was a firewall issue on pfsense, you would of still seen the pings - just they would not of been allowed up the stack to be answered.

SteveITS

@johnpoz New “laissez-faire” firewall technology…eh, it’s probably OK, sure, go ahead.

michmoor

@SteveITS the best kind of firewall policy

binfree

@denitrosubmena said in PLEASE stop enforcing firewall rules on pfsense!!! Let us manage our own firewall rules!!!:

My use-case i have pfsense installed at the edge and i need to access it via the WAN address that is public, like every other hardware router in the damn world that is the one that connects directly to internet

To be fair, there's no router anywhere, sold commercially, that's set up to allow access from the public WAN to its webGUI. At least not any that didn't ship without being misconfigured by accident at the factory. Are you suggesting you wanted pf to forward 80 and 443 by default? This is all rhetorical anyway, as pf definitely allows a local connection to the WAN port during setup, which makes things much easier. When LAN has been set up, it's obviously not needed anymore.

@denitrosubmena said in PLEASE stop enforcing firewall rules on pfsense!!! Let us manage our own firewall rules!!!:

proxmox which was blocking everything

I'm new here, but even I think it would have been a great idea to mention right away that pfSense was being virtualized. And on top of that, behind some POS like Proxmox.