Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Outgoing rules ?

    Scheduled Pinned Locked Moved Firewalling
    14 Posts 3 Posters 3.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      pfsense_user_123
      last edited by

      So ok, I can do rules like that.

      block in quick on int_if from any to <bogons>So I'll not push garbage throught WAN int, because this traffic will be  block on INT_IF before it achieve WAN.

      But what in situation like this:
      One machine (eg alix) 3 lan int.

      LAN1–------------LAN2----------LAN3-----------WAN
      10.0.0.0/8         172.16.0.0/12       192.168.0.0/16        x.x.x.x

      And what with traffic generated directly from firewall (eg log in to console, ssh, to WAN_if and ping 10.0.0.1 ? )
      Without rule block out, i will push packet throught wan int to the public network.</bogons>

      1 Reply Last reply Reply Quote 0
      • P
        pfsense_user_123
        last edited by

        Local traffic never goes over the router/pfSense.

        Are You sure ?
        Couse my tcpdump says something different.
        On WAN int i see icmp packet with source IP of my public WAN and dst eg 10.0.0.1 and it goes to operator network!

        1 Reply Last reply Reply Quote 0
        • P
          pfsense_user_123
          last edited by

          llow-rule: source: LAN, destination: "allowed_local_traffic"

          This will pass traffic QUICK state!, so other rules won't be checked.

          So packet will go pass throught WAN int. (if I use eg allowed_local_traffic = 10.0.0.0/8)

          1 Reply Last reply Reply Quote 0
          • GruensFroeschliG
            GruensFroeschli
            last edited by

            @pfsense_user_123:

            So ok, I can do rules like that.

            block in quick on int_if from any to <bogons>So I'll not push garbage throught WAN int, because this traffic will be  block on INT_IF before it achieve WAN.

            But what in situation like this:
            One machine (eg alix) 3 lan int.

            LAN1–------------LAN2----------LAN3-----------WAN
            10.0.0.0/8        172.16.0.0/12      192.168.0.0/16        x.x.x.x

            And what with traffic generated directly from firewall (eg log in to console, ssh, to WAN_if and ping 10.0.0.1 ? )
            Without rule block out, i will push packet throught wan int to the public network.</bogons>

            With a setup like this you'd simply update your alias containing your local nets.

            No traffic generated by the pfSense won't be blocked.
            But then, the pfSense shouldn't be generating traffic in the first place, should it?
            I've read that it is possible to block traffic from the pfSense itself with floating rules, but i never used this nor do i know how.

            @pfsense_user_123:

            Local traffic never goes over the router/pfSense.

            Are You sure ?
            Couse my tcpdump says something different.
            On WAN int i see icmp packet with source IP of my public WAN and dst eg 10.0.0.1 and it goes to operator network!

            Did you generate this ping on the pfSense itself?
            If yes, see above.
            Did you generate this on a computer behind the pfSense? If yes, then this packet was sent to the upstream gateway because it wasn't destined for a local net.
            Otherwise the routing table would have sent it to the correct local net and not the the next hop.

            @pfsense_user_123:

            llow-rule: source: LAN, destination: "allowed_local_traffic"

            This will pass traffic QUICK state!, so other rules won't be checked.

            So packet will go pass throught WAN int. (if I use eg allowed_local_traffic = 10.0.0.0/8)

            See above:
            The frame will only be passed to the next hop if the net doesn't exist locally.
            Of course if you say you have the whole 10/8 net locally in the firewall-rule but you don't, this will go to the WAN.
            Your aliases and actual existing local nets have to match.

            We do what we must, because we can.

            Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

            1 Reply Last reply Reply Quote 0
            • P
              pfsense_user_123
              last edited by

              I've found solution.
              Rule syntax with "out" is available in "floating" bookmark.
              So I create rule.
              block quick out on EXT_IF from any to <bogons>:-)
              WORKS FINE.

              I've also try concept of blocking packet on "inbound" on local interface. (witch could be better solution to block unwanted garbage very fast before it reaches inside router)
              And it work's in half way.

              It looks like only TCP traffic with flags S/SA is checked by this rule. (witch is obviously)
              pass in log quick on vr0 inet from 192.168.1.0/24 to ! <private_networks_out>flags S/SA keep state label "USER_RULE"
              pass in log quick on vr0 inet from 192.168.1.0/24 to ! <bogons_out>flags S/SA keep state label "USER_RULE"
              Packet with SYN flags match to rule and it's blocked.
              But the rest of traffic (ICMP) is not going to the default block rule! - and it escapes from WAN int

              00:00:00.000000 AF IPv4 (2), length 64: my.public.ip > 10.1.1.1: ICMP echo request, id 62842, seq 8458, length 40
              00:00:05.499144 AF IPv4 (2), length 64: my.public.ip > 10.1.1.1: ICMP echo request, id 62842, seq 8970, length 40
              00:00:05.499085 AF IPv4 (2), length 64: my.public.ip > 10.1.1.1: ICMP echo request, id 62842, seq 9482, length 40
              00:00:05.499103 AF IPv4 (2), length 64: my.public.ip > 10.1.1.1: ICMP echo request, id 62842, seq 9994, length 40
              00:00:05.499114 AF IPv4 (2), length 64: my.public.ip > 10.1.1.1: ICMP echo request, id 62842, seq 10506, length 40

              hmnnn any idea ?</bogons_out></private_networks_out></bogons>

              1 Reply Last reply Reply Quote 0
              • C
                cmb
                last edited by

                the flags only apply to TCP traffic, that rule will match ICMP also. Any traffic initiated from the firewall itself will not hit the default deny rule.

                1 Reply Last reply Reply Quote 0
                • P
                  pfsense_user_123
                  last edited by

                  I know that.

                  But the ping was initiated from machine in NAT'ed network.

                  Tcpdump runs on WAN int (and the output you see is NATed packet on WAN int)

                  1 Reply Last reply Reply Quote 0
                  • C
                    cmb
                    last edited by

                    The ICMP is matching some other rule that's passing it then. If it's passed before it hits that 'block out', that won't apply.

                    1 Reply Last reply Reply Quote 0
                    • P
                      pfsense_user_123
                      last edited by

                      That was first I checked.

                      There are no ICMP rules.

                      #pfctl -s rules
                      scrub in on pppoe0 all no-df random-id fragment reassemble
                      scrub in on vr0 all no-df random-id fragment reassemble
                      anchor "relayd/" all
                      block drop in log all label "Default deny rule"
                      block drop out log all label "Default deny rule"
                      block drop in quick inet6 all
                      block drop out quick inet6 all
                      block drop quick proto tcp from any port = 0 to any
                      block drop quick proto tcp from any to any port = 0
                      block drop quick proto udp from any port = 0 to any
                      block drop quick proto udp from any to any port = 0
                      block drop quick from <snort2c>to any label "Block snort2c hosts"
                      block drop quick from any to <snort2c>label "Block snort2c hosts"
                      block drop quick from <pfsnortsamout>to any label "Block pfSnortSamOut hosts"
                      block drop quick from any to <pfsnortsamin>label "Block pfSnortSamIn hosts"
                      block drop in log quick proto tcp from <sshlockout>to any port = ssh label "sshlockout"
                      block drop in log quick proto tcp from <webconfiguratorlockout>to any port = https label "webConfiguratorlockout"
                      block drop in quick from <virusprot>to any label "virusprot overload table"
                      block drop in log quick on pppoe0 from <bogons>to any label "block bogon networks from WAN"
                      block drop in on ! pppoe0 inet from my.public.ip to any
                      block drop in inet from my.public.ip to any
                      block drop in on pppoe0 inet6 from fe80::20d:b9ff:fe21:a5cc to any
                      block drop in log quick on pppoe0 inet from 10.0.0.0/8 to any label "block private networks from wan block 10/8"
                      block drop in log quick on pppoe0 inet from 127.0.0.0/8 to any label "block private networks from wan block 127/8"
                      block drop in log quick on pppoe0 inet from 172.16.0.0/12 to any label "block private networks from wan block 172.16/12"
                      block drop in log quick on pppoe0 inet from 192.168.0.0/16 to any label "block private networks from wan block 192.168/16"
                      block drop in on ! vr0 inet from 192.168.1.0/24 to any
                      block drop in inet from 192.168.1.1 to any
                      block drop in on vr0 inet6 from fe80::20d:b9ff:fe21:a5cc to any
                      pass in on vr0 inet proto udp from any port = bootpc to 255.255.255.255 port = bootps keep state label "allow access to DHCP server"
                      pass in on vr0 inet proto udp from any port = bootpc to 192.168.1.1 port = bootps keep state label "allow access to DHCP server"
                      pass out on vr0 inet proto udp from 192.168.1.1 port = bootps to any port = bootpc keep state label "allow access to DHCP server"
                      pass in on lo0 all flags S/SA keep state label "pass loopback"
                      pass out on lo0 all flags S/SA keep state label "pass loopback"
                      pass out all flags S/SA keep state allow-opts label "let out anything from firewall host itself"
                      pass out route-to (pppoe0 my.public.gateway) inet from my.public.ip to ! my.public.ip flags S/SA keep state allow-opts label "let out anything from firewall host itself"
                      pass out on enc0 all flags S/SA keep state label "IPsec internal host to host"
                      pass in quick on vr0 proto tcp from any to (vr0) port = http flags S/SA keep state label "anti-lockout rule"
                      pass in quick on vr0 proto tcp from any to (vr0) port = https flags S/SA keep state label "anti-lockout rule"
                      pass in quick on vr0 proto tcp from any to (vr0) port = ssh flags S/SA keep state label "anti-lockout rule"
                      anchor "userrules/                      " all
                      pass in quick on pppoe0 inet from 83.238.181.5 to my.public.ip flags S/SA keep state label "USER_RULE: PASS ZRE" queue(qGames, qACK)
                      pass in quick on pppoe0 inet proto tcp from any to my.public.ip port = https flags S/SA keep state label "USER_RULE"
                      pass in quick on vr0 inet from 192.168.1.0/24 to 192.168.1.1 flags S/SA keep state label "USER_RULE"
                      pass in log quick on vr0 inet from 192.168.1.0/24 to ! <bogons_out>flags S/SA keep state label "USER_RULE"
                      pass in log quick on vr0 inet from 192.168.1.0/24 to ! <private_networks_out>flags S/SA keep state label "USER_RULE"
                      pass in quick on enc0 all flags S/SA keep state label "USER_RULE"
                      pass in quick on openvpn all flags S/SA keep state label "USER_RULE"
                      pass out on pppoe0 route-to (pppoe0 my.public.gateway) inet proto udp from any to any port = isakmp keep state label "IPsec: any - outbound isakmp"
                      pass in on pppoe0 reply-to (pppoe0 my.public.gateway) inet proto udp from any to any port = isakmp keep state label "IPsec: any - inbound isakmp"
                      pass out on pppoe0 route-to (pppoe0 my.public.gateway) inet proto udp from any to any port = sae-urn keep state label "IPsec: any - outbound nat-t"
                      pass in on pppoe0 reply-to (pppoe0 my.public.gateway) inet proto udp from any to any port = sae-urn keep state label "IPsec: any - inbound nat-t"
                      pass out on pppoe0 route-to (pppoe0 my.public.gateway) inet proto esp all keep state label "IPsec: any - outbound esp proto"
                      pass in on pppoe0 reply-to (pppoe0 my.public.gateway) inet proto esp all keep state label "IPsec: any - inbound esp proto"
                      anchor "tftp-proxy/*" all

                      #pfctl -s nat
                      nat-anchor "natearly/" all
                      nat-anchor "natrules/                      " all
                      nat on pppoe0 inet from 192.168.1.0/24 port = isakmp to any port = isakmp -> my.public.ip port 500
                      nat on pppoe0 inet from 192.168.33.0/24 port = isakmp to any port = isakmp ->my.public.ip port 500
                      nat on pppoe0 inet from 192.168.254.0/24 port = isakmp to any port = isakmp -> my.public.ip port 500
                      nat on pppoe0 inet from 127.0.0.0/8 port = isakmp to any port = isakmp -> my.public.ip port 500
                      nat on pppoe0 inet from 192.168.1.0/24 to any -> my.public.ip port 1024:65535
                      nat on pppoe0 inet from 192.168.33.0/24 to any -> my.public.ip port 1024:65535
                      nat on pppoe0 inet from 192.168.254.0/24 to any -> my.public.ip port 1024:65535
                      nat on pppoe0 inet from 127.0.0.0/8 to any -> my.public.ip port 1024:65535
                      nat on pppoe0 inet from 127.0.0.1 to any -> my.public.ip port 1024:65535
                      rdr-anchor "relayd/" all
                      rdr-anchor "tftp-proxy/                      " all
                      rdr pass on pppoe0 inet proto udp from any to my.public.ip port = tftp -> 127.0.0.1 port 69
                      rdr-anchor "miniupnpd" all

                      #ftp 10.1.1.1
                      #tcpdump -n -e -ttt -i pflog0 host 10.1.1.1
                      tcpdump: WARNING: pflog0: no IPv4 address assigned
                      tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
                      listening on pflog0, link-type PFLOG (OpenBSD pflog file), capture size 96 bytes
                      00:00:00.000000 rule 42/0(match): pass in on vr0: 192.168.1.2.3663 > 10.1.1.1.21:  tcp 28 [bad hdr length 0 - too short, < 20]

                      #ping 10.1.1.1
                      #tcpdump -n -e -ttt -i pppoe0 host 10.1.1.1
                      tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
                      listening on pppoe0, link-type NULL (BSD loopback), capture size 96 bytes
                      00:00:00.000000 AF IPv4 (2), length 64: my.public.ip > 10.1.1.1: ICMP echo request, id 22837, seq 49676, length 40</private_networks_out></bogons_out></bogons></virusprot></webconfiguratorlockout></sshlockout></pfsnortsamin></pfsnortsamout></snort2c></snort2c>

                      1 Reply Last reply Reply Quote 0
                      • P
                        pfsense_user_123
                        last edited by

                        OK,
                        where can I found this rule in web-gui-configurator

                        pass out route-to (pppoe0 my.public.gateway) inet from my.public.ip to ! my.public.ip flags S/SA keep state allow-opts label "let out anything from firewall host itself"
                        ???

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.