Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Restricting internet access by IP and time range

    Scheduled Pinned Locked Moved Firewalling
    43 Posts 5 Posters 16.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • KOMK
      KOM
      last edited by

      OK, at least now we know your LAN really is 192.168.1.0/24.  I assume your test client is 192.168.1.112?  Edit your block rule to make the Source a Single host or alias, save it, clear the states and try again.

      1 Reply Last reply Reply Quote 0
      • _
        _ToXIc_
        last edited by

        i used "Network" instead of "Single host or alias" because network gave me an option to change the subnet with "Single host or alias" its greyed out and wouldnt let me change it.

        trying now..

        edit: attached the new rule

        Capture.JPG
        Capture.JPG_thumb
        Capture2.JPG
        Capture2.JPG_thumb

        1 Reply Last reply Reply Quote 0
        • _
          _ToXIc_
          last edited by

          still had internet after restarting the states… so i rebooted the firebox and the test device (iPhone) but still had internet.

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            No %&&^&^ idea what you've done.

            Reset to factory and start over. Start simple. One thing at a time. Test. Move on.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • KOMK
              KOM
              last edited by

              Verify that your test client is really at 192.168.1.112?  Your LAN rule should block all traffic from that IP address.

              1 Reply Last reply Reply Quote 0
              • _
                _ToXIc_
                last edited by

                its crazy.. so after testing last night i disabled the rule and played some xbox live..

                then sometime this morning around 5am or so all internet was blocked..
                so I deleted the rule rebooted and everything came back.

                1 Reply Last reply Reply Quote 0
                • _
                  _ToXIc_
                  last edited by

                  @Derelict:

                  No %&&^&^ idea what you've done.

                  Reset to factory and start over. Start simple. One thing at a time. Test. Move on.

                  '
                  this is my 3rd time starting over i've been implementing slowly and testing as i go.

                  @KOM:

                  Verify that your test client is really at 192.168.1.112?  Your LAN rule should block all traffic from that IP address.

                  it is.. its not static tho but its the IP currently leased..

                  1 Reply Last reply Reply Quote 0
                  • KOMK
                    KOM
                    last edited by

                    OK then, as long as you have cleared any established states from that IP address, it shouldn't be able to talk at all.  Are you sure it isn't flipping to cellular?

                    1 Reply Last reply Reply Quote 0
                    • _
                      _ToXIc_
                      last edited by

                      @KOM:

                      OK then, as long as you have cleared any established states from that IP address, it shouldn't be able to talk at all.  Are you sure it isn't flipping to cellular?

                      no i have the wifi assist is turned off.. and this morning i was getting time outs on everything

                      1 Reply Last reply Reply Quote 0
                      • KOMK
                        KOM
                        last edited by

                        I don't know what else to tell you.  This normally just works.  Being able to allow/block traffic is the basis for any firewall, and pfSense wouldn't be much good if it couldn't do at least that much.

                        1 Reply Last reply Reply Quote 0
                        • _
                          _ToXIc_
                          last edited by

                          right i'm baffled..

                          edit: unless this is related
                          https://forum.pfsense.org/index.php?topic=73012.0

                          1 Reply Last reply Reply Quote 0
                          • _
                            _ToXIc_
                            last edited by

                            thx for the assists over there KOM.. i'll try the block this evening to see it that outbound rule was messing with it..

                            1 Reply Last reply Reply Quote 0
                            • _
                              _ToXIc_
                              last edited by

                              dang.. no change setting a single block rule like the screen shot i posted previously breaks the internet for everyone..

                              1 Reply Last reply Reply Quote 0
                              • KOMK
                                KOM
                                last edited by

                                I'm not sure how blocking a single host would interfere with everyone…

                                Can you post updated shots of your LAN firewall rules?  Hopefully you just disabled the problem rule instead of deleting it.

                                1 Reply Last reply Reply Quote 0
                                • _
                                  _ToXIc_
                                  last edited by

                                  i deleted it but its the same as whats posted in #20

                                  here my lan and wan rules

                                  the only other firewall changes that have been made is whats in the post#29 to get my xbox NAT to open

                                  Capture.JPG
                                  Capture.JPG_thumb
                                  Capture2.JPG
                                  Capture2.JPG_thumb

                                  1 Reply Last reply Reply Quote 0
                                  • DerelictD
                                    Derelict LAYER 8 Netgate
                                    last edited by

                                    It's blocking everyone because you're using a /24, dude.  It's single host or /32

                                    Chattanooga, Tennessee, USA
                                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                    1 Reply Last reply Reply Quote 0
                                    • _
                                      _ToXIc_
                                      last edited by

                                      sorry forgot about that, did the single hosts reboots and it kinda works.. cant dont anything on the phone but Facebook works lol

                                      no web and mostly the other apps i tried but facebook works

                                      1 Reply Last reply Reply Quote 0
                                      • DerelictD
                                        Derelict LAYER 8 Netgate
                                        last edited by

                                        Like I said, reboot to factory and start over.  No idea what you have where.

                                        Look at your firewall rules on LAN and see what rule is blocking what.

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        1 Reply Last reply Reply Quote 0
                                        • kesawiK
                                          kesawi
                                          last edited by

                                          If you have the transparent proxy enabled in pfsense then you may also need to add a custom ACL to the proxy settings to limit access during specific times if you're still finding you have web access.

                                          Below is a rule I use for my kid's devices at night while allowing their devices to still download updates:

                                          ##  day-abbrevs:
                                          #	S - Sunday
                                          #	M - Monday
                                          #	T - Tuesday
                                          #	W - Wednesday
                                          #	H - Thursday
                                          #	F - Friday
                                          #	A - Saturday
                                          
                                          ###Domains used for downloading google and itunes updates
                                          ##YouTube domain used for other account login
                                          acl gLogin dstdomain accounts.youtube.com
                                          ##Google Playstoe
                                          acl gStore dstdomain .gvt1.com .googleusercontent.com .ggpht.com .google.com .gstatic.com .android.com .googleapis.com
                                          ##iTunes Store
                                          acl iTunes dstdomain .apple.com .apple.com.edgesuite.net mzstatic.com
                                          
                                          ## Deny access from kids devices late at night
                                          acl KidsDevices src 192.168.1.40/29 192.168.1.48/31
                                          acl night time 22:00-24:00
                                          acl morning time 00:00-6:00
                                          http_access deny KidsDevices night !gStore !iTunes !gLogin
                                          http_access deny KidsDevices morning !gStore !iTunes !gLogin
                                          
                                          ##Deny access from kids devices after 8:45pm on school nights
                                          acl school_night time SMTWH 20:45-22:00
                                          http_access deny KidsDevices school_night !gStore !iTunes !gLogin 
                                          
                                          
                                          1 Reply Last reply Reply Quote 0
                                          • _
                                            _ToXIc_
                                            last edited by

                                            WOW so now i'm really clueless.. instead of resetting and doing a factory reset. took out the CF card and wrote a fresh copy of 2.2.6-RELEASE (i386) onto it.

                                            went trough the initial wizard and and then tested the block rule then reset stats and ever rebooted and same thing.. the test device which is my phone was still able to connect to the internet.

                                            it makes no sense. if it wasnt for the performance bandwidth wise i getting out of this i would of chucked it by now..

                                            why is blocking so hard?

                                            Capture.JPG
                                            Capture.JPG_thumb

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.