Can't Get It Working
-
When you first configure pfSense the first interface is labelled WAN and the second is labelled LAN. Subsequent interfaces are labelled OPT1, OPT2, OPT3 etc. I point this out because yo can rename the interfaces anything you want and you have referred to both your internal interfaces as LAN. The first LAN interface has a firewall rule setup by default to allow out all traffic originating from that subnet, the "Default allow LAN to any rule". So you do not need to add any further rules to the LAN interface in order to get internet access. If you look at Firewall: Rules: LAN(tab) in the webgui you will see it as well as a rule to prevent you getting locked out of the webgui.
Only the LAN has that default rule. All other traffic must be explicitly allowed by rules you've added.
Steve
-
When you first configure pfSense the first interface is labelled WAN and the second is labelled LAN. Subsequent interfaces are labelled OPT1, OPT2, OPT3 etc. I point this out because yo can rename the interfaces anything you want and you have referred to both your internal interfaces as LAN. The first LAN interface has a firewall rule setup by default to allow out all traffic originating from that subnet, the "Default allow LAN to any rule". So you do not need to add any further rules to the LAN interface in order to get internet access. If you look at Firewall: Rules: LAN(tab) in the webgui you will see it as well as a rule to prevent you getting locked out of the webgui.
Only the LAN has that default rule. All other traffic must be explicitly allowed by rules you've added.
Steve
Yeah, my second LAN is labeled OPT1. Specifically, what do I need to do to OPT1 to get it set up like the LAN port?
-
You'll need to add a firewall rule to OPT1 to permit traffic to egress that network;
PASS
IPv4
source "OPT1 net"
source port ANY
destination ANY
destination port ANYKeep in mind that LAN and OPT1 will be able to communicate because both the LAN and OPT1 have rules that "Permit ANY". If you want to block this, you'll need to add a rule on LAN that says 'BLOCK LAN net to OPT1 net', and on OPT1 that says 'BLOCK OPT1 net to LAN net'. These 'Block' rules will need to be placed ABOVE the Permit ANY rule.
-ct
-
You can probably get away with going into Firewall->Rules->LAN and clicking on the "+" besides the "Default allow LAN to any rule", which will copy that rule and make a new one you can change. It will take you into the details and you can simply change the Interface from LAN to OPT1.
Save it, Apply changes, then your good to go.
Edit:
As per cthomas, if you want to BLOCK traffic, you can add further rules to LAN,OPT1 or both. -
You can probably get away with going into Firewall->Rules->LAN and clicking on the "+" besides the "Default allow LAN to any rule", which will copy that rule and make a new one you can change.
Ah, it's never occurred to me that you could do that. You learn something everyday. :)
However you will also have to change the source address from LAN net to OPT1 net.Steve
-
Yes, the source address change is one of those "oh yeah, don't forget to change that too…" I remember when I'm looking at the rule sheet - not while I'm typing :(
Thanks for the catch :)
-jfp
-
Ok, I'm able to access the internet through both LAN ports on my firewall HOWEVER, I can also access the web GUI on either port using either IP address. No matter which LAN port I'm on I can sign in to the GUI with 192.168.2.1 and 192.168.3.1
That shouldn't be happening, right?
-
That is the expected behaviour if you have 'allow any' rules on each LAN interface.
Steve
-
I tried changing the "allow any" rule to "allow WAN subnet to LAN1 subnet" but then I can't access anything over that port. I put back the allow any rule and it works but I can also access both ports from either again.
-
I tried changing the "allow any" rule to "allow WAN subnet to LAN1 subnet" but then I can't access anything over that port. I put back the allow any rule and it works but I can also access both ports from either again.
If you're just trying to stop LAN from seeing OPT1 (and vice versa), you can add a LAN1 rule:
"Allow LAN to NOT OPT1 subnet"
And similarly on OPT1
"Allow OPT1 to NOT LAN"
Depends on what you're trying to acheive
-
Yep. Or you can explicitly block access to the OPT1 interface address from the LAN subnet with a block rule placed above the 'allow any' rule. Then you can still access devices on OPT1 from LAN.
-
I'm not sure if I'm doing this right so here's a screen cap of what I did. There was no change.
-
So you want to BLOCK going anywhere but that lan segment? That is what that rule would do.
Post your lan rules so we can see exactly what other rules you have in place, etc. That rule by itself would block everything but the lan segment. So you would not be able to go to the internet.. Is that what your after?
-
Enter firewall block rules on the "LAN" or "OPT1" for port 80 and 443 from "LAN" or "OPT1" to "IP of ROUTER", then nobody can reach the interface from this LAN / OPT1
-
Hmm, that rule is definitely wrong. It will never (or should never) match any traffic as you will never see any packets going into the LAN interface that have source 'SERVER subnet'.
What exactly are you trying to achieve?
Steve
-
I didn't even catch the server source ;) Yeah that would never even trigger.
-
What I'm trying to do is keep the SERVER and LAN ports from being able to communicate with each other.
I don't want anyone on my home network to accidently get access to my little web server and screw something up. And I don't want any traffic for the server getting onto my home network.
-
Ok I think I got it fixed. I looked in the 'Definitive Guide to PFSense' and it said: "Rules in PFSense are applied on a per-interface basis, always in the inbound direction on that interface. This means traffic initiated from the LAN is filtered using the LAN interface rules.Traffic initiated from the Internet is filtered with the WAN interface rules."
So I changed the source on Server TO server and source on LAN to LAN and now the two ports don't appear to be able to access each other.
-
Sounds good.
If you're in any doubt post up some screen shots of your rules. :)Steve
-
Ok, here's the rules for my LAN and SERVER ports.
