Firewall: Scheduling block game console
-
Hi Everyone,
I would like to Schedule a block rule for my son's xbox 360 from 9 PM until 6 am Monday to Friday, block all traffic to or from my son's xbox. I have the rule in place. If he using the gaming console at 9 pm the firewall doesn't stop the traffic. I think I have everything setup correctly. what am I doing wrong?
any help or thoughts would be great.
Chris
-
Without seeing what you've actually done it's pretty much impossible to say what you've done wrong.
Also, I don't think existing states are removed when the schedule disables the rule. It might not appear to kill all connections right at 9pm, but it should become unusable shortly thereafter if it's set up correctly.
-
For starters, schedule allow rules, instead of block rules.
-
Hi!
I made this setup (scheduled block rule) work by:
-
install package Cron
-
create in Cron (GUI -> Services -> Cron) a job to be executed daily at 09:01 pm doing
/sbin/pfctl -F states
which basically kills all states (for ALL users, killing it for the single user didn't work for me since updating to pfsense 2.2).
That will definitely stop all traffic to the Xbox ;-)
To check you can have a look at GUI -> Diagnostics -> States at 09:02 pm, you won'T find any states for the IP of the Xbox any more. If you look earlier for States than 09:02 pm, the browser will become unresponsive for the GUI at 09:01 pm, as all states are killed. Simple press refresh button of your browser and your connection will come back (but not for the Xbox, as the block-rule will prevent this after 09:00 pm).
Have fun
chemlud
-
-
And all your ssh and other persistent sessions go with it. Yuck.
looks like pfctl -k could be more specifically targeted.
-k host | network | label | id Kill all of the state entries matching the specified host, network, label, or id. For example, to kill all of the state entries originating from ``host'': # pfctl -k host -
I guess you are right (that was my solution pre-2.2), but have a look here:
https://forum.pfsense.org/index.php?topic=87731.msg482378#msg482378
;-)
-
Seemed to work for me.
-
OK, maybe things have changed, I give it a try tonight…
-
Thanks Everyone
For your help.
-
Again, for pfctl -k for 3 out of 4 IPs at least one state (port 80 or 443) was still there one minute after block rule and cron job should have killed the internet connection. No idea what's wrong here…
Maybe the pfctl -k is started befor the block becomes effective, so in placed it not at 21:01... see how it works tomorrow.
-
Yeah, again – schedule allow rules and NOT the block ones. But for sure you can keep banding your head against the wall for a couple more months. Good luck.
-
When you schedule pass rules instead of block rules are associated states automatically purged when the rule is disabled or something?
If not I don't see the difference. He'd also need a block rule after the pass rule.
pass xbox scheduled
block xbox
pass everything elseInstead of:
block xbox scheduled
pass everything else -
When you schedule pass rules instead of block rules are associated states automatically purged when the rule is disabled or something?
If not I don't see the difference. He'd also need a block rule after the pass rule.Yeah, the difference it that when the default is to block, then you don't need to pray for the states to get purged. There are no states, the traffic is being blocked by default until allowed. It works. Really. Try it. Scheduled block rules don't.
He'd also need a block rule after the pass rule.
pass xbox scheduled
block xbox
pass everything elseInstead of:
block xbox scheduled
pass everything elseNo. He'd need
- pass xbox scheduled
- pass everything else but xbox
- (default block everything, no rule needed for this)
-
Ah. I'm not a fan of "pass/block all except x" rules.
I still don't see the difference.
If there are states when the block rule fires, those states are still there until cleared.
If there are states when the pass rule expires, those states are still there until cleared. -
I have only limited ports allowed, some for the whole local subnet(s), some for each specific client. No way to have that done with scheduled allow rules without a lot of trouble.
It is simply unprofessional to have scheduled block rules but not to care if they work.
My opinion.
-
They work fine. Like everywhere else, when you set a rule it doesn't affect existing states and they have to be cleared either organically or by force.
I had to set a schedule for one of my kids once. I just didn't sweat that everything didn't stop working exactly when the rule fired. Worked fine and accomplished its goal even if it was a little fuzzy on exactly when everything stopped working. All you really have to do is break DNS. That makes about everything useless.
-
eeeh, leaving kiddies half the night with some games, music channels or messengers that work on with existing states for every is not "they work fine" for me. Sorry.
-
So use cron and pfctl to kill the states.
-
No problem to me, as long as the -k worked properly, in the pre-2.2 era. But now I have to kill all states to make it really work. Dunno why. Always the states with
re1 tcp routerIP(localIP) -> remoteIP ESTABLISHED…
in the states tab survive the -k procedure.
That's not fair. :-(
-
Update: selective killing of states with option -k is broken, leaves a lot of states in place, as pointed out above. No way around kicking off all users by killing all their states.
