Can't Get It Working
-
So you want to BLOCK going anywhere but that lan segment? That is what that rule would do.
Post your lan rules so we can see exactly what other rules you have in place, etc. That rule by itself would block everything but the lan segment. So you would not be able to go to the internet.. Is that what your after?
-
Enter firewall block rules on the "LAN" or "OPT1" for port 80 and 443 from "LAN" or "OPT1" to "IP of ROUTER", then nobody can reach the interface from this LAN / OPT1
-
Hmm, that rule is definitely wrong. It will never (or should never) match any traffic as you will never see any packets going into the LAN interface that have source 'SERVER subnet'.
What exactly are you trying to achieve?
Steve
-
I didn't even catch the server source ;) Yeah that would never even trigger.
-
What I'm trying to do is keep the SERVER and LAN ports from being able to communicate with each other.
I don't want anyone on my home network to accidently get access to my little web server and screw something up. And I don't want any traffic for the server getting onto my home network.
-
Ok I think I got it fixed. I looked in the 'Definitive Guide to PFSense' and it said: "Rules in PFSense are applied on a per-interface basis, always in the inbound direction on that interface. This means traffic initiated from the LAN is filtered using the LAN interface rules.Traffic initiated from the Internet is filtered with the WAN interface rules."
So I changed the source on Server TO server and source on LAN to LAN and now the two ports don't appear to be able to access each other.
-
Sounds good.
If you're in any doubt post up some screen shots of your rules. :)Steve
-
Ok, here's the rules for my LAN and SERVER ports.
 -
Looks good, that should block all IPv4 traffic between the LAN and SERVER subnets. :)
It won't block IPv6 traffic if you are using IPv6 at all. Change the TCP/IP version to 'any' if you want to block v6 too.Steve
-
Thanks for all the help.
