Blocked internet but it's still "Kind of" working
-
I'm creating firewall rules to manage the kid's internet time. It does appear to be working but one thing really thew me off when testing.
When the rule is enabled, I can't ping 8.8.8.8 or Google.com. However, when I perform a random google search, I get results back but when clicking on any result it doesn't work.
So technically, I think it was a success. But it begs the question, what else "kind of works" and how do I configure this so that the internet is certainly not working.
-
@cheapie408 Can you show the rules?
Also check https://docs.netgate.com/pfsense/en/latest/troubleshooting/firewall.html#new-rules-are-not-applied
-
@SteveITS
The rule that I used to test this on is for one of my laptop that my son uses. I have 2 other rules that are aliases base that is setup identical to this.I also have ipV6 completely disabled in pfSense and all devices IP addresses are using DHCP reservation.
In addition, I'm using Home Assistant to disable/enable the rules which is confirmed to work.
This rule is at the very top of the list just below the Anti-Lockout Rule.
-
@cheapie408 and did you validate your states are flushed.. If you go to google.com, and then block internet - there is still a state to google.com - where yeah you can search on google. But any results you try to go to would be blocked - because that would be a new state.
When you create a new block rule - you have to either kill any existing states, or wait for them to time out on their own, etc.
It is gone over in the link @SteveITS provided.
States are evaluated before rules.. if there is an existing state to xyz.. Doesn't matter if you have a rule that would prevent future states to xyz.. Until you kill that state to xyz, or it times out on its own - yeah still going to be able to go to xyz.
-
@johnpoz, I did go into Diagnostics - States and reset states, if that's what you're asking.
-
@cheapie408
Remember that adding / enabling a block rule does not delete existing states.
So probably there was an existing connection for Google and you could reuse it.If you intend to provide scheduled access to the internet, use a pass rule for this. Only a pass rule can remove the belonging states at the time it expires.
-
@cheapie408 if you killed all the states, and you can still go somewhere - then your rules are not blocking what you want to block. You sure the states were killed off?
Look in the state table - if there is a state, then your rule didn't block it, or it wasn't killed when you thought you reset it.,
-
In fact, I do intend on having rules that are scheduled base as well. The idea is to implement a parental control using a combination of Home Assistant and PFSense. I know that I can enable/disable rules in Pfsense from home assistant so to simplify it, I can just create a regular non scheduled rules inside of pfsense and use Home Assistant automation to enable/disable the rules.
HA also gives me the ability to control the rules on the fly.Your thoughts?
As you're saying, if only a pass rule can remove the states, using a block rule as I'm using it now will not work if I'm enabling and disabling the rule on a dialy basis?
So for my purpose, what might the pass rule look like? I played with it a little this morning and couldn't quite figure it out.
-
@cheapie408 you would put your pass rule on a schedule..
https://docs.netgate.com/pfsense/en/latest/firewall/time-based-rules.html
-
@cheapie408
And followed by a block rule for the same source, so that following pass rules don't take effect. -
So this is what I got,
Created alias for RFC1918 with 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
created a pass rule for the (single host) and block rule as shown. The passrule should remain active and when I want to turn on/off internet, I'd enable/disable the block rule?
-
@cheapie408 You can also create a schedule, and add an entry to the schedule each time you want to grant extra access. Something like:
Mon - Fri / 6:00-7:00 / Weekday mornings
Wed / 7:00-7:15 / Late start day
Mon - Fri / 15:00-18:45 / Weekday evenings
Sat - Sun / 13:00-16:00 / Weekends
August 7 / 0:00-20:59 / (added extra time today)The block rule needs to always be enabled, so 2 rules:
- allow LL laptop during schedule
- block LL laptop
as noted in
https://docs.netgate.com/pfsense/en/latest/firewall/time-based-rules.html
Or you can just enable/disable the allow rule.
