OPT1 Firewall Rules

[turku31]

@Uglybrian
I'm using it this way to keep my Stereo, Tv, etc., silioed from other devices on the network.
I am following the advice of a Naomi Brockwell's video on YouTube, who is well-versed on the topic, whereas I am only a newbie.
I had it working on OPNSense but I since have switched to pfsense. In either event, I have tried the two choices that had OPT1 in its description, but fails to connect.

[Uglybrian]

After creating your OPT1 did you enable it? same for the DHCP server for that segment.

Once you create a new interface you need to enable it and hit save at the bottom.

[johnpoz]

@turku31 said in OPT1 Firewall Rules:

but fails to connect.

And what firewall logs do you see? Out of the box the default deny is logged and would show you what traffic is hitting your interface and being denied.

but as mentioned - did you actually enable dhcp on this interface? Are you clients on this opt network actually getting an IP from pfsense for the network you put on your opt1 interface?

Common mistake I have seen when users creating a new interface, is it defaults to a /32 mask - which wouldn't work and wouldn't even allow you to enable dhcp, etc.

[Uglybrian]

@johnpoz said in OPT1 Firewall Rules:

defaults to a /32 mask

I bet that is the hang up. I have made this mistake before.

[turku31]

@Uglybrian
So here are screenshots of pfsense firewall configurations for both OPT1 and OPT2. In the pfsense screenshot you don't see the choice of OPT1.NET for source; in the video screenshots, you do.
I am on version 2.8.1.
I believe this to be the crux of the matter. Unless there is a way creating this choice, I don't know.

[johnpoz]

@turku31 dude it hasn't be nets for many many versions now.. It has been subnets - I dont recall when they changed it.. But many many moons ago

And again it would never be address.. If your address on your opt1 interface was 192.168.66.1 - then that is what opt1 address would be... How would a rule to allow traffic into your opt1 network interface be itself??

How about you show us what your actual firewall rules are you have on opt1 - for all we know you have block rfc1918 clicked on it? What is the address you put on it. Is it a /24? Do you clients get an IP from dhcp? What does your log say when its not working - like from your client ping pfsense opt1 address?

edit:
I just found some idiot video on the internet that was for version 2.4.5 that shows nets vs subnets? Maybe that was the one you were looking at.. That idiot was creating a rule of source opt1 nets destination opt1 nets - and labeled it "allow access within subnet" <rolleyes> Why do idiots that do not have a clue put out shit videos showing how they don't understand what they are trying to show others to do?

edit2: This idiot tech beatz has 777 subscribers? got to be kidding me..

edit3: This idiot shouldn't be within 100 feet of a firewall - let alone putting out videos to explain how to do things to others.

[chpalmer]

@johnpoz said in OPT1 Firewall Rules:

idiot shouldn't be within 100 feet of a firewall

And still somehow said idiot will be able to get a job.. fake his/her way through it long enough.. get protected by a union so his/her employer will not be able to fire his/her *ss..

/soapbox

/rant

sorry.. long day.

[johnpoz]

@chpalmer hahaha - exactly ;)

[jdeloach]

@johnpoz said in OPT1 Firewall Rules:

@turku31 dude it hasn't be nets for many many versions now.. It has been subnets - I dont recall when they changed it.. But many many moons ago

John, how does one enable subnets, appears to still be nets in 2.6.x or early 2.7.x in the GUI?

All I see in the GUI is "... nets", no "... subnets".

[johnpoz]

@jdeloach really?? Maybe they changed in plus before.. Why would you still be running such old versions.. 2.6 is like from 22, and even 2.7.2 is going on 2 years old. 2.7 is no longer support even.

I know its been multiple updates back in plus.

[Uglybrian]

Turku to be clear on your interface rules for the source you will want OPT1 net or OPT1 subnet. Your destination should be ‘’any’’. There are two different versions of PF Sense CE and Plus so some of the wording may be different. I don’t know. I am on the plus version.
But I don’t think this is your problem as you stated earlier, you’ve tried it both ways with net and addresses in the source. You need to go back and double or triple check other settings that are necessary for a new segment to work. Johnpoz has pointed out under interfaces the mask setting. Is your mask set to 24? If your mask is still a 32 it doesn’t matter what rules you put in the interface. It will not work.

[turku31]

@johnpoz
The idea is to 'silo' the networks--not allowing, separating them from one another, in this case, OPT1.NET to not have access to OPT2 or LAN.
All I know is, as shown in the screenshot, that it did exist, but no longer.
I was thinking if I reverted back to an earlier pfsense, say 2.7.2 version, where OPT1.NET still existed in the list, that when upgrading it would simply carryover and work in the 2.81 version.
Just a thought.
I don't know if it is permissible to post a link to YouTube but here is the link to what information I am trying to incorporate into my network.
https://www.youtube.com/watch?v=yKyjbeObQXg

[johnpoz]

@turku31 why would you revert to get nets when its the exact same thing as subnets??

If you do not want opt 1 network to talk to lan net/subnet for example.. then create a rule blocking opt1 subnet from talking to lan net/subnet

If you do not want this network talking to any of your networks you could create multiple rules, or just create a alias with either all rfc1918 space in it, or your specific networks.

What do you want to allow this opt1 net/subnet to do and block it from doing and I will post up a simple picture of the rules you would set..

For example here these rules would block access from opt 1 to your lan network, and allow everything else

Clearly you would do this on your opt1 interface, where mine says test - substituting opt 1 subnets where mine says test subnets, etc.

Rules are evaluated top down, first rule to trigger wins, no other rules are evaluated.

edit: here is more advanced locked down network

It allows clients on this network to ping, dns and ntp to pfsense address on this network. It then blocks any other access to any other IP on pfsense (this would include pfsense public IP on the wan interface for example) This would prevent clients on this network from accessing the pfsense web gui or any other services on any pfsense IP.

It then blocks any access to any rfc1918 space (10.x, 192.168.x, 172.16-31.x) via an alias created that contains these networks.

It then allows anything else - ie internet.

Adjust as you see fit for your want/need for this network.

[turku31]

First off, OPT1 t is enabled. It is set for /24. Insofar as the logs go there are quite a few, even too many.
Yes, I did enable dhcp.

[Uglybrian]

@turku31 so what do the logs show???

[johnpoz]

Exactly lets see your rule set.. Lets see a log entry that you feel is wrong, or don't understand. What is not working exactly?

Do you have any rules in floating tab? These rules if set to quick would be evaluated before rules on the interface. If you are trying to block traffic.. If you have a state open already before you put in a block you would need to either wait for that state to time out, or kill it before your block would take effect.

Without some details, its not really possible for anyone to help you figure out what is not working the way you want it to work.

[turku31]

The simple answer is I have tried every option available, and none is able to connect to the Internet, short of Any, which would defeat the purpose.. And since the video link I posted, instructs you to choose OPT1.NET as the Source, it's not possible to do so if it doesn't exist.
Pardon my lack of knowledge regarding all this, but I will have to study what you've provided to gain a better understanding of what I can/should do to remedy it all.
I greatly appreciate your response.

[turku31]

I tried posting all the logs but it was perceived as spam and it wouldn't let me.

[johnpoz]

@turku31 post a screenshot. You try and post some wall of text - yeah most likely it will think its spam.. Or link to it if you post it somewhere else, etc.

choose OPT1.NET as the Source, it's not possible to do so if it doesn't exist.

Dude no offense but how dense are you trying to be.. It was changed from net to subnets.. Its the same freaking thing!

As to not being able to get to the internet - the internet is vast amount of IPs.. How would you think you could allow them all specifically or even in net blocks.. The internet is ANY as a destination.. If you want to block access to X, then create that rule before you ANY rule that allows access to the internet.

[Uglybrian]

Bunk utube videos have you down the primrose path to nowhere. Other than these forums and here
https://docs.netgate.com/pfsense/en/latest/index.html and here https://www.youtube.com/NetgateOfficial/videos. there is no better place to get you started. none.
Does your version of PF Sense have a question mark in the top right corner or a help pull down.

The question mark will take you to the relevant gui page of PF Sense book. Help will take you to the PF Docs.