How to Schedule Internet Access?

doktornotor

For me all of this is still some years away. My oldest is only 5 yet. :)

firewalluser

For me all of this is still some years away. My oldest is only 5 yet. :)

I wrote my first code when I was 7 taught by a computer science graduate with one of the first ZX81's. Never underestimate the learning potential of young minds if its kept fun & entertaining especially if they dont know its supposed to be hard otherwise they will put up psychological barriers to learning.

P3R

@firewalluser:

Never underestimate the learning potential of young minds…

I'm not and I'll be the one doing the teaching. I'd love to have another network administrator in the family, even if that means I'll eventually be outsmarted.

I started with a DIY ZX81 as well but I was a little older… ;)

Nonsense

O.K. guys, after all the philosophical debate and the fun, let's get back to my questions, please:

I assume that using these rules won't affect my default rules (e.g., "bogon," etc.)?

Also, I highlighted the days of the week of the current month and set the times of days in the scheduler; will this keep the schedule in perpetuity or do I need to do something else?

And, I also assume that I can use a single rule if I just block all devices on my network according to a schedule?

Thanks.

2chemlud

https://forum.pfsense.org/index.php?topic=94678.msg526090#msg526090

Don't use scheduled BLOCK rules, broken!

Schedule ALLOW rules!

almabes

Without a screen shot of ALL your rules, I couldn't say for sure.
The bogon rules are on the WAN interface.
But the point of adding rules to the firewall is to NOT have the default activity.

Post a screen shot of your schedule, but sounds like it's set up to run in perpetuity.

A single rule will do the job, if you have a single entity on a single interface you wish to regulate.

Again, don't schedule a BLOCK rule. Schedule a PASS rule. The firewall won't kill states if you have a block rule that becomes effective. It WILL kill states if you have a PASS rule that disables.

And if you have late to all night LAN gaming issues, Wagner's Die Valkyrie, or Tchaikovsky's 1812 overture played at high volume in the early morning tends to nip that in the bud pretty quick, at least around here. I haven't had to fire up the turntable in the morning in at least a couple of months.

Nonsense

I prefer the 1958 Dorati recording. :-*

Nonsense

The Host DNS Server Override Blocker rule prevents a host from specifying its own DNS addresses and the DayPass rule is what I implemented in relation to this topic; the rest of my rules are the pfSense defaults.

ScreenShot.jpg_thumb

Schedule.jpg_thumb

almabes

Your top allow rule is not specific enough. Create an alias containing only all the addresses you want to allow and use the alias or your source address. After you do that, you're golden.

Right now your rules say:
BLOCK external dns.
PASS any traffic from my LAN net arriving on the LAN interface destined for any host or service anywhere.
PASS any traffic from any address arriving on the LAN interface destined for any host or service anywhere, only between these times.

First applicable rule wins.

You want them to say:
BLOCK external dns.
PASS any traffic from alias unlimited_access arriving on the LAN interface destined for any host or service anywhere.
PASS any traffic from any address arriving on the LAN interface destined for any host or service anywhere, only between these times.

Then, if you need to add a host to the unlimited_access alias, you just edit it, hit apply and your device surfs without a schedule.

Derelict

@2chemlud:

Don't use scheduled BLOCK rules, broken!

Not broken. Design choice. If you thought about it for two minutes you'd understand why.

2chemlud

I thought about that for MONTHS now and as a dumb firewall user I came to the final conclusion:

I want all states to be killed if I set up a block rule.

What I don't get: Why did the update to 2.2 also take away the option to kill states by pfctl -k? It worked definitely before, as I said, I get an email with the states every evening before and after block/states killing cron job. It worked before! But now I have to kill all states after the block rule to cut off exisiting states.

Nonsense

O.K., almabes, thanks; I didn't even consider the impact of the default rule that comes out of the box with a new pfSense installation: "Default allow LAN to any rule." I'll disable it and modify the new rule(s) which I have created.

Nonsense

My scheduling kicked in last night–and my kids were none too happy about it--thanks again to all.