Firewall rule issue
-
This is the first time I am having a problem on PFSense with a firewall rule and I must be missing something simple! I keep seeing 192.168.20.4 being blocked from accessing 192.168.20.65, when my first and third rule should be allowing this! I only added the first two rules listed here after the third appeared to be failing. Any suggestions on what I might be missing? I have refreshed state table and rebooted the firewall as well. Thank you!
-
@dy_atx
This seems to be an asymmetric routing issue.
Most probably reason for this is that one of the involved devices is multi-homed. -
@dy_atx said in Firewall rule issue:
192.168.20.4 being blocked from accessing 192.168.20.65, when my first and third rule should be allowing this
Devices in the same subnet don't cross the firewall so no rules should ever apply. Unless those are both not in a /24.
re: Asymmetric Routing, see
https://docs.netgate.com/pfsense/en/latest/troubleshooting/log-filter-blocked.html#asymmetric-routing
https://docs.netgate.com/pfsense/en/latest/troubleshooting/asymmetric-routing.html -
@dy_atx yeah that screams asymmetrical, normally with 192.168.20.0/24 192.168.20.4 would not send anything to router to talk to 192.168.20.65.
So from that I would think your mask is wrong on 20.4 and he thinks 20.65 is on a different network and when he got a syn to his 12812 port he sent back his syn,ack (SA) to pfsense (his gateway)..
-
Thank you both! This was exactly the issue; subnet was configured incorrectly on the device at 192.168.20.4! Thank you!!
