Blocked internet but it's still "Kind of" working
-
@cheapie408
And followed by a block rule for the same source, so that following pass rules don't take effect. -
So this is what I got,
Created alias for RFC1918 with 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
created a pass rule for the (single host) and block rule as shown. The passrule should remain active and when I want to turn on/off internet, I'd enable/disable the block rule?
-
@cheapie408 You can also create a schedule, and add an entry to the schedule each time you want to grant extra access. Something like:
Mon - Fri / 6:00-7:00 / Weekday mornings
Wed / 7:00-7:15 / Late start day
Mon - Fri / 15:00-18:45 / Weekday evenings
Sat - Sun / 13:00-16:00 / Weekends
August 7 / 0:00-20:59 / (added extra time today)The block rule needs to always be enabled, so 2 rules:
- allow LL laptop during schedule
- block LL laptop
as noted in
https://docs.netgate.com/pfsense/en/latest/firewall/time-based-rules.html
Or you can just enable/disable the allow rule.
-
@cheapie408 background to was @SteveITS mentioned: the first firewall rule that matches will be used:
"Rulesets on the Interface tabs are evaluated on a first match basis. This means that reading the ruleset for an interface from top to bottom, the first rule that matches will be the one used by the firewall."
https://docs.netgate.com/pfsense/en/latest/firewall/fundamentals.html
-
@patient0 exactly and if the allow is on a schedule when time hits that the rule is not enabled, ie say after 10pm every night then any states created by that allow rule would be removed. If they try and go back they hit the block rule (which you currently have disabled) and the firewall would not allow, and no state created.
-
@SteveITS
So to make this less complicated and take scheduling out of the equation of pfsense. Say I wanted to rely on Home Assistant to enable the block rule, so in PFSense there should only be one rule that I toggle.Based on what everyone is suggesting, this is what my setting looks like. I deleted all my previous and starting from scratch. These are mainly tablets and streaming device and they do not need local access when internet is off. When it's down time it's lights out.
The pass rule is above the block rule for Elise's devices. The block rule remains enabled at all time and because the pass rule is above the block rule, when it is enabled, it will ignore the block rule and allow traffic through. So when I want to turn on/off internet, the pass rule is what I'll be toggling. Sounds about right?
-
@cheapie408 said in Blocked internet but it's still "Kind of" working:
So when I want to turn on/off internet, the pass rule is what I'll be toggling. Sounds about right?
Kind of, yes. It's the same as a scheduled rule but you're manually turning it on and off. Which is why we all digressed, I guess. :)
I am however unclear on whether any open states will be killed once the rule is disabled. I suspect they are not, and it is the schedule that handles that.
There's a discussion and a few possible options on this Reddit thread, found in a quick search.
-
@SteveITS not sure why something like this couldn't be simplier in pfsense, the logic is simple. I guess the claim of "enterprise level" adds some weirdness to it.
I tested this just now on my own laptop just replacing elise's device with my own IP.
This is what I observed, when pass rule is disabled, it takes maybe 30 2nd before pinging starts to fail. If I have a youtube video playing, the entire video will complete but will fail on the following video.
Google search no shows no internet and browsing to website also no longer works.
I'm reading up on the link you provided now. Kids are smart these days, they figure out how to bypass the block anyway they can so we gotta be ahead of them. LOL
-
@cheapie408 said in Blocked internet but it's still "Kind of" working:
takes maybe 30 2nd before pinging starts to fail
Yeah that's the open state ending. Also the video, because the connection is not yet closed. It might stop if you pause playback long enough, not sure. IOW new connections are blocked.
Since we have no admin access to our son's school Chromebook and I wanted to leave IPv6 active, we use the pfSense Plus feature to block its MAC address. I did create my wife a pfSense login to access only (IIRC) the firewall schedules, though she mostly just asks me to edit them. So I can add an entry for "today," default start time "12 am" (who cares) and I set an end time.
Windows/iPhone/iPad are different but at least there we have the MS/Apple parental controls.
-
In my case the "kids" are all grown up & moved out, but few years back I went through all this pain. For many years I simply showed them the firerwall logs & used "embarassed teenager" mode to get them to self limit.
Full blocks frequently caused moans of "can't I just have 10 more minutes", etc.
The best solution was speed limiting their laptop, phones & game consoles to about 50kbps (or less). They couldn't complain "the internet" wasn't working because searches still worked, but most things became unusable !! Then an hour later full block.
-
I will keep this advise in my parenting note pad and apply it in a couple years. I like it!
