FIREWALL RULES FOR TRAFFIC BETWEEN INTERFACES
-
Err…no, I don't think so.
Could you give us a diagram of your network? I'm confused as to quite how you have things connected from your description.Steve
-
I need to know if it is possible to make the devices with ip address between the same network but different interface, to comminicate each other (blue line).
But not the 10.x devices that should not go out from the LAN interface
Let me know if it isn't clear.
-
So those are just extra subnets? If so, you are going to have to create an IP Alais in each subnet before the pfSense machine will route properly. If you have a router on each side handling those subnets, then you are going to have to add that route in the pfSense firewall before it routes correctly. how are you normally getting traffic between subnets?
-
Even if they are just extra subnets you still can't do that because you have the same subnet behind each interface. For example: if a packet comes into pfSense addressed to 192.168.2.10 which interface should it be routed to? There is no way to know.
The only way I can see to do this, keeping the subnets as labelled, would be with VLANs and bridging but that's a fairly complex setup.
It would be much easier to, for example, change the subnets behind LAN to .11.X and .12.X.
Is there some reason you can't do that?Steve
-
If it is the same, just create one IP alias in say 2.x one LAN and 1.x on opt (for some balancing) and that should be able to route how you need. If they are separate, then stephenw10 is correct and I would change the subnets to 11.x 12.x on LAN and 13.x and 14.x on the OPT with IP aliases all around.
-
thanks for your explanation, I'm trying to keep it simple, avoiding VLANs (for now, someday who knows…).
I've tried with iP alias from Virtual IP like this:
192.168.2.1/24 [IP Alias] on LAN
192.168.1.1/24 [IP Alias] on OPT2
I can ping them, then I've added them as gateways and this is the route:
192.168.2.0/24 gw1 - 192.168.1.1 OPT2
but maybe I lost something…
if ping 192.168.2.12 that is on OPT2 don't get the answerI can change the networks on the LAN but how can I route 12.x with 13.x?
-
ok I'm alittle confused,
to simplify all, if for example I want to reach the networks on the other interface from the 10.x and get their reply, but don't allow the traffic coming from the opt2 to lan interface if isn't a reply from a request from the LAN, could it be possile?
-
Yes certainly.
Just put a firewall rule on LAN to allow traffic with source 192.168.10.X and destination 192.168.1-2.X.
This would already be included in the default 'LAN to any' rule if you haven't changed it.
As long as you don't put a rule on OPT2 to specifically allow traffic in the other direction it will be blocked.Your Virtual IP should be 192.168.2.0/24 on OPT2.
Are you using static IPs on the clients on OPT2?
Steve
-
Thanks for your help, but it seems I miss something.
Tried to ping a device on opt2 from lan but still got a message of host unreachable, I've checked with wire shark what happen:
as source I see the MAC of opt2 , destination broadcast, protocol ARP, info who has 192.168.2.33 ? tell 192.168.10.10
why broadcast message are sended on lan from opt2? -
Summer … I would put an allow all rule on all interfaces until you made sure that your routing is correct. Once you know routing is working correct, then you can go back and restrict traffic how you need to. Also,
on pfSense
LAN : 192.168.10.3/24
OPT1: 192.168.1.3/24
IP Alias on OPT1: 192.168.2.3/24Computers on LAN of pfSense use the gateway of 192.168.10.3.
Computers on the OPT1 use either 192.168.1.3 or 192.168.2.3 as their gateway depending on the subnet they are on.If you have a different gateway for .1.0/24 and .2.0/24, you are going to have to create a route in that router to poing .10.0/24 to either .2.3 or .1.3 base on the subnet from which it comes. If you don't then setting up a route should not be necessary.
I think that auto outbound NAT for WAN should be able to handle all the subnets and give them internet. If not you are going to have to create a rule in NAT to handle that.
No additional route are needed as pfSense should be able to route to all the interface networks and the IP Alias network.
Then you just have to deal with firewall rules allowing the traffic needed. -
podilarius! you've made it! :) Really thanks for the help!
the gateway on the opt2 devices make them availables from LAN.
But I can ping the devices without gateway from the pfsense interface and get the reply, is there a way to forward the reply if the request cames from LAN?
-
Yes there is, because normally router uses nearest interface to that network. so in this schema it used "gateway" ip-address which is in same subnet with those devices which has no gateway information
-
The reason you can ping them from pfSense is just the same as if you ping a computer on the same network. There is no need to route, since they are on the same subnet. Default gateways are just telling the computer that if it cannot find a route on its on, check with your default gateway. You can add a persistent route to the devices on opt2 if you need to keep the current default gateway separate from the pfSense machine. You would have to do that on all the devices. if you were to add a route to the that subnet's router then it would apply to all devices.
-
Last question with a PC Win7, with 2 NIC on separate networks, one on OPT2 and one with default gateway that goes out without interesting pfsense, is there a way to reach the Nic on OPT2 network ?
I mean I've added a route to network 192.168.10.0 with gateway 192.168.1.1, and changed metric of interfacs, but still can't communicate. -
Give some more what you want to achieve and```
route print -
not really, but you can get to the machine on the default LAN, so why do you need to access it on opt2? You usually split networks with potentially a NIC in both subnets, usually to manage on both subnets.
-
The default LAN of the Win7 PC is different from the one of pfsense, that is the problem, i've got
NIC 1 : default LAN DIFFERENT from the LAN of Pfsense
NIC 2: address on OPT2 network,I've added a route to the LAN of Pfesense
IP ADDRESS MASK GATEWAY INTERFACE METRIC
192.168.10.0 255.255.255.0 192.168.2.3 192.168.2.133 2000 >>> to reach LAN of pfsense
0.0.0.0 255.255.255.0 x.x.x.x x.x.x.133 4000 >>> default LANIf I tracert google from the win7 it pass trough the x.x.x.x133, if tracert an address 192.168.10.x it doesn't call the default but goes directly to the address.
But if I ping the win7 pc from behind the LaN I can't reach it. -
Weird mask you have on your default Wan connection. I have 0.0.0.0
And i think that no harm is made if you reduce your metric value of that on-site subnet -
sorry I didn't copy and pasted, a writing error the correct one is
IP ADDRESS MASK GATEWAY INTERFACE METRIC
192.168.10.0 255.255.255.0 192.168.2.3 192.168.2.133 2000 >>> to reach LAN of pfsense
0.0.0.0 0.0.0.0 x.x.x.x x.x.x.133 4000 >>> default LANif I ping from ssh from firewall I can get reply, if I do from LAN behind firewall no.
The problem is that the others hosts, not with Win7 can be accessed from LAN behind firewall with the current rules. -
What is the status of the Windows firewall in the Win7 machine? usually Win 7 firewall will not accept connections from a subnet that is not represented by a NIC. Also check your RDP settings also to make sure you can connect from anywhere.
