Restricting internet access by IP and time range
-
@KOM:
sorry what do you mean "reset the states"
Diagnostics - States - Reset States
thanks
whats so funny about the source?
Looks like you're trying to block an entire network as opposed to a single host.
ah.. that explains a bunch.. gotta look up blocking
-
Please post a screenshot of your block rule as I requested previously.
-
@KOM:
Please post a screenshot of your block rule as I requested previously.
i posted the block rule in reply#10 been reading and reading trying this and that but i can get the basic block to work.
-
The rule you have in #10 should block all traffic from 192.168.1.0/24 into the LAN interface (and out to the internet).
If it is not doing so, then LAN net is not 192.168.1.0/24
Post Status > Interfaces
At least the LAN interface.
-
so i should put the IP i'm trying to block in the Destination field instead of Source? i tried that also and reset the states but my test device was still getting to the internet
-
i posted the block rule in reply#10
Sorry, don't know how I missed that :P
so i should put the IP i'm trying to block in the Destination field instead of Source?
No, you want to use the client IP you're testing with as the Source. Please post your interface details as Derelict requested. Once we see what we're working with, it will take away a lot of the guesswork.
-
@KOM:
No, you want to use the client IP you're testing with as the Source. Please post your interface details as Derelict requested. Once we see what we're working with, it will take away a lot of the guesswork.
but isnt that how its setup in the rule?
attached are the interfaces
-
OK, at least now we know your LAN really is 192.168.1.0/24. I assume your test client is 192.168.1.112? Edit your block rule to make the Source a Single host or alias, save it, clear the states and try again.
-
i used "Network" instead of "Single host or alias" because network gave me an option to change the subnet with "Single host or alias" its greyed out and wouldnt let me change it.
trying now..
edit: attached the new rule
-
still had internet after restarting the states… so i rebooted the firebox and the test device (iPhone) but still had internet.
-
No %&&^&^ idea what you've done.
Reset to factory and start over. Start simple. One thing at a time. Test. Move on.
-
Verify that your test client is really at 192.168.1.112? Your LAN rule should block all traffic from that IP address.
-
its crazy.. so after testing last night i disabled the rule and played some xbox live..
then sometime this morning around 5am or so all internet was blocked..
so I deleted the rule rebooted and everything came back. -
No %&&^&^ idea what you've done.
Reset to factory and start over. Start simple. One thing at a time. Test. Move on.
'
this is my 3rd time starting over i've been implementing slowly and testing as i go.@KOM:
Verify that your test client is really at 192.168.1.112? Your LAN rule should block all traffic from that IP address.
it is.. its not static tho but its the IP currently leased..
-
OK then, as long as you have cleared any established states from that IP address, it shouldn't be able to talk at all. Are you sure it isn't flipping to cellular?
-
@KOM:
OK then, as long as you have cleared any established states from that IP address, it shouldn't be able to talk at all. Are you sure it isn't flipping to cellular?
no i have the wifi assist is turned off.. and this morning i was getting time outs on everything
-
I don't know what else to tell you. This normally just works. Being able to allow/block traffic is the basis for any firewall, and pfSense wouldn't be much good if it couldn't do at least that much.
-
right i'm baffled..
edit: unless this is related
https://forum.pfsense.org/index.php?topic=73012.0 -
thx for the assists over there KOM.. i'll try the block this evening to see it that outbound rule was messing with it..
-
dang.. no change setting a single block rule like the screen shot i posted previously breaks the internet for everyone..
-
I'm not sure how blocking a single host would interfere with everyone…
Can you post updated shots of your LAN firewall rules? Hopefully you just disabled the problem rule instead of deleting it.
-
i deleted it but its the same as whats posted in #20
here my lan and wan rules
the only other firewall changes that have been made is whats in the post#29 to get my xbox NAT to open
-
It's blocking everyone because you're using a /24, dude. It's single host or /32
-
sorry forgot about that, did the single hosts reboots and it kinda works.. cant dont anything on the phone but Facebook works lol
no web and mostly the other apps i tried but facebook works
-
Like I said, reboot to factory and start over. No idea what you have where.
Look at your firewall rules on LAN and see what rule is blocking what.
-
If you have the transparent proxy enabled in pfsense then you may also need to add a custom ACL to the proxy settings to limit access during specific times if you're still finding you have web access.
Below is a rule I use for my kid's devices at night while allowing their devices to still download updates:
## day-abbrevs: # S - Sunday # M - Monday # T - Tuesday # W - Wednesday # H - Thursday # F - Friday # A - Saturday ###Domains used for downloading google and itunes updates ##YouTube domain used for other account login acl gLogin dstdomain accounts.youtube.com ##Google Playstoe acl gStore dstdomain .gvt1.com .googleusercontent.com .ggpht.com .google.com .gstatic.com .android.com .googleapis.com ##iTunes Store acl iTunes dstdomain .apple.com .apple.com.edgesuite.net mzstatic.com ## Deny access from kids devices late at night acl KidsDevices src 192.168.1.40/29 192.168.1.48/31 acl night time 22:00-24:00 acl morning time 00:00-6:00 http_access deny KidsDevices night !gStore !iTunes !gLogin http_access deny KidsDevices morning !gStore !iTunes !gLogin ##Deny access from kids devices after 8:45pm on school nights acl school_night time SMTWH 20:45-22:00 http_access deny KidsDevices school_night !gStore !iTunes !gLogin
-
WOW so now i'm really clueless.. instead of resetting and doing a factory reset. took out the CF card and wrote a fresh copy of 2.2.6-RELEASE (i386) onto it.
went trough the initial wizard and and then tested the block rule then reset stats and ever rebooted and same thing.. the test device which is my phone was still able to connect to the internet.
it makes no sense. if it wasnt for the performance bandwidth wise i getting out of this i would of chucked it by now..
why is blocking so hard?
-
Is your phone getting the same IP address each time it connects to your WiFi? Have you turned off mobile data on your phone when performing the test (if your phone gets blocked on your WiFi network it may be switching to the mobile network)?
-
i set the ip as static also it jailbroken so i can see the IP on the top bar.
but tried disabling the mobile data and still got access to the internet
-
Does your WAN have IPv6 as well as IPv4? The phone could be operating on IPv6 and your block only works on IPv4.
Have you tried disabling the two default allow rules on the LAN interface to see if traffic is blocked?
Try enabling logging in the rules to see if they are being triggered. You could also run a packet capture under the diagnostics menu to see what traffic from your phone is hitting the LAN interface.
Have you looked through https://doc.pfsense.org/index.php/Firewall_Rule_Troubleshooting?
Not sure what else to suggest.
-
thanks for the suggestions.. i'll try them