Blocked internet but it's still "Kind of" working
-
@cheapie408 and did you validate your states are flushed.. If you go to google.com, and then block internet - there is still a state to google.com - where yeah you can search on google. But any results you try to go to would be blocked - because that would be a new state.
When you create a new block rule - you have to either kill any existing states, or wait for them to time out on their own, etc.
It is gone over in the link @SteveITS provided.
States are evaluated before rules.. if there is an existing state to xyz.. Doesn't matter if you have a rule that would prevent future states to xyz.. Until you kill that state to xyz, or it times out on its own - yeah still going to be able to go to xyz.
-
@johnpoz, I did go into Diagnostics - States and reset states, if that's what you're asking.
-
@cheapie408
Remember that adding / enabling a block rule does not delete existing states.
So probably there was an existing connection for Google and you could reuse it.If you intend to provide scheduled access to the internet, use a pass rule for this. Only a pass rule can remove the belonging states at the time it expires.
-
@cheapie408 if you killed all the states, and you can still go somewhere - then your rules are not blocking what you want to block. You sure the states were killed off?
Look in the state table - if there is a state, then your rule didn't block it, or it wasn't killed when you thought you reset it.,
-
In fact, I do intend on having rules that are scheduled base as well. The idea is to implement a parental control using a combination of Home Assistant and PFSense. I know that I can enable/disable rules in Pfsense from home assistant so to simplify it, I can just create a regular non scheduled rules inside of pfsense and use Home Assistant automation to enable/disable the rules.
HA also gives me the ability to control the rules on the fly.Your thoughts?
As you're saying, if only a pass rule can remove the states, using a block rule as I'm using it now will not work if I'm enabling and disabling the rule on a dialy basis?
So for my purpose, what might the pass rule look like? I played with it a little this morning and couldn't quite figure it out.
-
@cheapie408 you would put your pass rule on a schedule..
https://docs.netgate.com/pfsense/en/latest/firewall/time-based-rules.html
-
@cheapie408
And followed by a block rule for the same source, so that following pass rules don't take effect. -
So this is what I got,
Created alias for RFC1918 with 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
created a pass rule for the (single host) and block rule as shown. The passrule should remain active and when I want to turn on/off internet, I'd enable/disable the block rule?
-
@cheapie408 You can also create a schedule, and add an entry to the schedule each time you want to grant extra access. Something like:
Mon - Fri / 6:00-7:00 / Weekday mornings
Wed / 7:00-7:15 / Late start day
Mon - Fri / 15:00-18:45 / Weekday evenings
Sat - Sun / 13:00-16:00 / Weekends
August 7 / 0:00-20:59 / (added extra time today)The block rule needs to always be enabled, so 2 rules:
- allow LL laptop during schedule
- block LL laptop
as noted in
https://docs.netgate.com/pfsense/en/latest/firewall/time-based-rules.html
Or you can just enable/disable the allow rule.
-
@cheapie408 background to was @SteveITS mentioned: the first firewall rule that matches will be used:
"Rulesets on the Interface tabs are evaluated on a first match basis. This means that reading the ruleset for an interface from top to bottom, the first rule that matches will be the one used by the firewall."
https://docs.netgate.com/pfsense/en/latest/firewall/fundamentals.html
