Blocked internet but it's still "Kind of" working

cheapie408

In fact, I do intend on having rules that are scheduled base as well. The idea is to implement a parental control using a combination of Home Assistant and PFSense. I know that I can enable/disable rules in Pfsense from home assistant so to simplify it, I can just create a regular non scheduled rules inside of pfsense and use Home Assistant automation to enable/disable the rules.
HA also gives me the ability to control the rules on the fly.

Your thoughts?

As you're saying, if only a pass rule can remove the states, using a block rule as I'm using it now will not work if I'm enabling and disabling the rule on a dialy basis?

So for my purpose, what might the pass rule look like? I played with it a little this morning and couldn't quite figure it out.

johnpoz

@cheapie408 you would put your pass rule on a schedule..

https://docs.netgate.com/pfsense/en/latest/firewall/time-based-rules.html

viragomann

@cheapie408
And followed by a block rule for the same source, so that following pass rules don't take effect.

cheapie408

So this is what I got,

Created alias for RFC1918 with 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16

created a pass rule for the (single host) and block rule as shown. The passrule should remain active and when I want to turn on/off internet, I'd enable/disable the block rule?

SteveITS

@cheapie408 You can also create a schedule, and add an entry to the schedule each time you want to grant extra access. Something like:

Mon - Fri / 6:00-7:00 / Weekday mornings
Wed / 7:00-7:15 / Late start day
Mon - Fri / 15:00-18:45 / Weekday evenings
Sat - Sun / 13:00-16:00 / Weekends
August 7 / 0:00-20:59 / (added extra time today)

The block rule needs to always be enabled, so 2 rules:

allow LL laptop during schedule
block LL laptop

as noted in

https://docs.netgate.com/pfsense/en/latest/firewall/time-based-rules.html

Or you can just enable/disable the allow rule.

patient0

@cheapie408 background to was @SteveITS mentioned: the first firewall rule that matches will be used:

"Rulesets on the Interface tabs are evaluated on a first match basis. This means that reading the ruleset for an interface from top to bottom, the first rule that matches will be the one used by the firewall."

https://docs.netgate.com/pfsense/en/latest/firewall/fundamentals.html

johnpoz

@patient0 exactly and if the allow is on a schedule when time hits that the rule is not enabled, ie say after 10pm every night then any states created by that allow rule would be removed. If they try and go back they hit the block rule (which you currently have disabled) and the firewall would not allow, and no state created.

cheapie408

@SteveITS
So to make this less complicated and take scheduling out of the equation of pfsense. Say I wanted to rely on Home Assistant to enable the block rule, so in PFSense there should only be one rule that I toggle.

Based on what everyone is suggesting, this is what my setting looks like. I deleted all my previous and starting from scratch. These are mainly tablets and streaming device and they do not need local access when internet is off. When it's down time it's lights out.

The pass rule is above the block rule for Elise's devices. The block rule remains enabled at all time and because the pass rule is above the block rule, when it is enabled, it will ignore the block rule and allow traffic through. So when I want to turn on/off internet, the pass rule is what I'll be toggling. Sounds about right?

SteveITS

@cheapie408 said in Blocked internet but it's still "Kind of" working:

So when I want to turn on/off internet, the pass rule is what I'll be toggling. Sounds about right?

Kind of, yes. It's the same as a scheduled rule but you're manually turning it on and off. Which is why we all digressed, I guess. :)

I am however unclear on whether any open states will be killed once the rule is disabled. I suspect they are not, and it is the schedule that handles that.

There's a discussion and a few possible options on this Reddit thread, found in a quick search.

cheapie408

@SteveITS not sure why something like this couldn't be simplier in pfsense, the logic is simple. I guess the claim of "enterprise level" adds some weirdness to it.

I tested this just now on my own laptop just replacing elise's device with my own IP.

This is what I observed, when pass rule is disabled, it takes maybe 30 2nd before pinging starts to fail. If I have a youtube video playing, the entire video will complete but will fail on the following video.

Google search no shows no internet and browsing to website also no longer works.

I'm reading up on the link you provided now. Kids are smart these days, they figure out how to bypass the block anyway they can so we gotta be ahead of them. LOL

SteveITS

@cheapie408 said in Blocked internet but it's still "Kind of" working:

takes maybe 30 2nd before pinging starts to fail

Yeah that's the open state ending. Also the video, because the connection is not yet closed. It might stop if you pause playback long enough, not sure. IOW new connections are blocked.

Since we have no admin access to our son's school Chromebook and I wanted to leave IPv6 active, we use the pfSense Plus feature to block its MAC address. I did create my wife a pfSense login to access only (IIRC) the firewall schedules, though she mostly just asks me to edit them. So I can add an entry for "today," default start time "12 am" (who cares) and I set an end time.

Windows/iPhone/iPad are different but at least there we have the MS/Apple parental controls.