Firewall Rule
-
Dear All,
Please see attached file for our existing firewall rule. Kindly explain to me what happening when this rule is used by pfsense.
Thank you in advance
-
Any traffic starting from LAN and going to FacebookIP will be blocked. Hover over "FacebookIP" or look in Firewall-Aliases to see what is FacebookIP. It might be a fixed list of IP networks, or a URL to a list of networks that pfSense is loading.
It will only be useful if the list contains all the IP networks used by Facebook. -
What should I do if I want to add another alias of IP for twitter or to block the twitter.com? I know I should know the ipaddress of twitter and make an alias of it and make a rule. Where should I put that alias? I want also to have an exemption for a certain LAN ip address to access these social network, how can we set-up on this?
When I add an firewall should I restart the pfsense?
Thank you in advance.
-
What should I do if I want to add another alias of IP for twitter or to block the twitter.com? I know I should know the ipaddress of twitter and make an alias of it and make a rule. Where should I put that alias?
First, create a new alias for Twitter IPs. Firewall->Aliases. You can use the facebook entry as an example.
Then, on the firewall rules for LAN, add a new rule based on the Facebook rule (The + on the facebook rule line.)
Change the facebook alias entry to the new twitter alias.
The twitter rule should go directly before or after the facebook rule.
pfSense firewall rules are, in general, evaluated from the first to the last. As soon as a rule matches the traffic, it's forwarded on its way.
I want also to have an exemption for a certain LAN ip address to access these social network, how can we set-up on this?
You would want to create another alias for the allowed IPs. You would then create a rule just above the twitter/facebook rules that passes traffic with a source of that alias to any.
When I add an firewall should I restart the pfsense?
Thank you in advance.
No. When you apply the changes to your rule set, all new connections will obey them. Existing connections will continue to function. If you want to dump existing connections (firewall states), use Diagnostics->States then reset states on the Reset States tab.
When you're making all these new aliases and adding the rules, you can wait until you're finished then apply the new rules once.
Opinion: Manually blocking sites like this is pretty much an exercise in futility.
-
"Opinion: Manually blocking sites like this is pretty much an exercise in futility."
Agreed – if you need to block sites like this, you should move to content filtering with a proxy like squid where you can block based upon url names and don't have to worry about the 100s if not 1000's of IPs that a site might be using.. Sites like these are served up off major CDNs, the ips are going to be constantly changing.. You also run into the possibility of blocking sites you don't want to block because the IP is shared, etc.
If you have 1 specific HOST, or even say a netblock you want to block sure -- but when you get to blocking major domains, doing it via firewall rules that look up an IP is not going to be very effective.
-
How can you block the sites that are using https protocol? Upon reading and searching website that are using https protocol cannot be block by squid guard in transparency mode.
Do you have any suggestion about this? I'm using the firewall to block the site because of this issue.
-
Then don't use transparency mode.. Duh!! ;)
-
I got your point not to use the transparency mode. But I chose to use that mode because to eliminate the configuration on the workstation and some of our workstation is mobile.
-
So use WPAD and autoconfiguration of the proxy then.. Duhh!!
-
So use WPAD and autoconfiguration of the proxy then.. Duhh!!
excuse me sir ;D
what is WPAD and i cant find menu on the proxy server?
i am so interest on filtered https with non transparency mode with autoconfig any devicebest regards :)
