Confusing firewall rule logic. Cant set destination to WAN net

router_wang

You want "dest any" to route to the internet.

That is the problem. Destination "ANY" goes to all your networks. There needs to be Destination "Internet" to only go out to the internet.

Derelict

@router_wang:

I'm saying that "destination WAN" is perceived as "destination internet".

That is an erroneous perception.

There is no selection to tell it that you only want the destination to be the internet and not anywhere else, as in NOT your other networks. The NOT only works with one selection at a time.

You can define an alias with hundreds or thousands of networks and say "not my_alias."

router_wang

@Derelict:

In 2.2 you will be able to say the equivalent of "not local networks."

Thanks!

johnpoz

"I'm saying that "destination WAN" is perceived as "destination internet""

Says who?? Clearly someone that no basic understanding of networking at all..

If you want a rule to allow internet access, but none of your local networks - then simple enough to create an alias with the local networks you don't want to access.. For example that is what I have on my dmz.

But no dest wan would not be seen as internet.

internetnotlocal.png_thumb

router_wang

@johnpoz:

"I'm saying that "destination WAN" is perceived as "destination internet""

Says who?? Clearly someone that no basic understanding of networking at all..

Or an acronym whose use is not clear at all. The Internet can be considered a WAN as well, and is used by businesses, governments, organizations, and individuals for almost any purpose imaginable. There is a LAN port, WAN port, and OPT1 port on my APU1C. The rules regarding LAN and OPT1 are clear, so I assumed the nomenclature regarding "WAN" was clear as well.

By all means, please elaborate on my lack of basic networking at all.

KOM

To pf, the stateful firewall in FreeBSD that is the heart of pfSense, WAN Net means only your WAN subnet and not the entire Internet. I also made this same mistake once. Use John & Derelict's suggestion of using an alias to hold all the local networks you want to deny access to. Lastly, don't take it personally. Johnpoz and Derelict are two of the top 5 people here for sure when it comes to network knowledge and pfSense, but sometimes our answers are a little rough around the edges.

router_wang

@KOM:

To pf, the stateful firewall in FreeBSD that is the heart of pfSense, WAN Net means only your WAN subnet and not the entire Internet. I also made this same mistake once. Use John & Derelict's suggestion of using an alias to hold all the local networks you want to deny access to. Lastly, don't take it personally. Johnpoz and Derelict are two of the top 5 people here for sure when it comes to network knowledge and pfSense, but sometimes our answers are a little rough around the edges.

The insults are inexcusable. My network experience goes all the way back to a freakin Apple Cat modem. And in all the years since, I have never degenerated to crapping on people asking for information. I hope the "elites" around here can grasp the fact that the majority of the user base is going to be your average Joe and not the sysadmin with a Cisco cert.

Build the user base with Honey. Not Vinegar.

johnpoz

Sorry but I just call it like I see it.. It says WAN net.. What other network would it be talking about?? So you grasp that lan "net" means the network attached to the LAN interface.. Why would Wan "net" mean "internet"??

In what firewall have you ever seen specification of wan net to mean all networks other than local? You need to state the actual network or IP that you want as source and destination, or ANY is the standard phrase for anything.. If your not going to be specific then ANY would be used..

As to crapping on people – How is providing you with an exact example how to accomplish what you want crapping on anyone? For all your years of experience you sure have a pretty thin skin.. Sorry but if anyone seems elitist -- might want to look in a mirror.. OMG the guy on the internet didn't slob all over my knob when I asked a question, he made a crack about the nomenclature used being clear to anyone with a basic grasp of the concepts being discussed.. What an elitist prick he must be!! :rolleyes:

"I have never degenerated to crapping on people asking for information"

That sure seems obvious from your clearly neg trending karma ;) Did you use up all your honey elsewhere?

router_wang

@johnpoz:

OMG the guy on the internet didn't slob all over my knob when I asked a question, he made a crack about the nomenclature used being clear to anyone with a basic grasp of the concepts being discussed.. What an elitist prick he must be!! :rolleyes:

Enjoy lording over your little kingdom and bathing in your own ego. It does nothing to expand the user base. It does nothing to promote the goodwill of the project. It serves no purpose other than to satisfy your need for attention. Good luck with that.

Harvy66

@router_wang:

@johnpoz:

"I'm saying that "destination WAN" is perceived as "destination internet""

Says who?? Clearly someone that no basic understanding of networking at all..

Or an acronym whose use is not clear at all. The Internet can be considered a WAN as well, and is used by businesses, governments, organizations, and individuals for almost any purpose imaginable. There is a LAN port, WAN port, and OPT1 port on my APU1C. The rules regarding LAN and OPT1 are clear, so I assumed the nomenclature regarding "WAN" was clear as well.

By all means, please elaborate on my lack of basic networking at all.

It seemed quite obvious to me. It's just a bit-mask check. PFSense is built by people with great understanding of networks and is biased towards that demographic. Many times making something easier for the layman makes it harder for the professional. I don't want my firewall second guessing or doing something implicitly.

Also, "WAN" is just a name you give to an Internet, it has no bearing on if it's "the internet". If you think of all Interfaces just being "Opt1", "Opt2", etc, then it makes perfect sense. "WAN" gets no special treatment just because of its name.

edit: Forgot to add, in a Core router, all interfaces can be "the internet". The concept of "the internet" is a bit overly simplistic.

johnpoz

dude you really need to check your med levels or something..

Derelict

It appears I misspoke. I just took a look at 2.2-BETA and, while there is a new selection for all defined interface addresses on the firewall (This Firewall (self)), there is not a new selection for all local networks. So it looks like we'll have to continue to maintain an alias for that.

johnpoz

Check your PM wang – you know it doesn't take a brain surgeon to notice every time my smite level changes you have just recently logged in.. Bit childish don't you think.. :rolleyes: