Question on Firewall Schedules in pfSense 2.3.2
-
Yes. You exhibit a fundamental misunderstanding of how firewall rules work, the ports you are trying to control, and generally dismiss anyone who tries to correct you.
Wow, anyone else have anything constructive to add?
-
Yes. You exhibit a fundamental misunderstanding of how firewall rules work, the ports you are trying to control, and generally dismiss anyone who tries to correct you.
Obviously I do not understand, hence the questions.
I have not dismissed anyone?
-
Are you sure the Steam ports being blocked should be source ports? Source ports are usually random to specific destination ports.
Back to your original question, as far as my understanding goes, the 'source' is the client on the LAN. Changing the ports or in this case the alias to 'destination' does not work at all.
Also, I do understand that usually source ports are random when forwarding ports (NAT) however is this the case in situations like this?
I do appreciate you responding however, you have not offered any solutions, only suggesting things are 'wrong'.
Again, first post - "As long as the schedules are not altered, everything works as expected.."
My issue was with altering the schedules and states, not with the rules themselves. I posted the rules to make sure I wasn't making a simple mistake.
I am no expert and I do read and try to work it out myself before asking for assistance.
Being a moderator on this forum, I would have expected a little less criticism and more assistance from you.. :o
-
I do appreciate you responding however, you have not offered any solutions, only suggesting things are 'wrong'.
Have you read the whole thread?
Things are not as you think they are. Source and destination ports are not what you think they are.
Every time someone tries to get that point across to you you say "but it sometimes works." Reasons have been given why that might be the case.
Yet here you are saying it doesn't work as you expect. That's because things do not work how you think they do.
None of this has anything to do with pfSense. It is basic IP networking.
Here's what you do. Forget about steam. Pick one IP address and one service. A good one might be DNS queries to DEST ADDR: 8.8.8.8 (HINT: SOURCE PORT: any DEST PORT: TCP/UDP 53) Figure out how to properly pass or block that traffic from a specific local host. Once you have that down the rest will be easy.
-
Here's what you do. Forget about steam. Pick one IP address and one service. A good one might be DNS queries to DEST ADDR: 8.8.8.8 (HINT: SOURCE PORT: any DEST PORT: TCP/UDP 53) Figure out how to properly pass or block that traffic from a specific local host. Once you have that down the rest will be easy.
Ok, I have created a simple BLOCK rule on the LAN tab in the firewall rules. I have assigned an ALIAS to the IP address and assigned the ALIAS to my iPad. When placing the ALIAS in DESTINATION all traffic is passed. When placing the ALIAS in SOURCE, all traffic is BLOCKED.
I have attached the working firewall rule and a snip of the logs.
-
Right. In that case you ARE filtering on the source to destination any.
-
Right. In that case you ARE filtering on the source to destination any.
That is how I have my Steam rules setup. wiht an ALLOW schedule. The issue I am experiencing is after modifying a schedule, not all states are flushing correctly after the schedule expires. I had a look in the firewall logs lastnight and they were UDP states. Could this be due to the way I have my alias setup? IE- all ports setup as TCP/UDP? You mentioned to seperate the ports and create seperate aliases and rules?
-
There is a HUGE difference between matching on source ADDRESSES and source PORTS! You want to match on specific source addresses with any source port and on any destination address with specific destination ports.
-
I am at a loss here and can't seem to work out why the states are not clearing when the schedule becomes active… All other access is blocked except for a few Steam ports which require a manual states reset.
Could someone please give me a hand? I can post/send whatever logs necessary, I will PayPal a $50 bounty if someone successfully helps me work this out.
-
$50 not enough?
