Routing or pass-through?

[c4bcons]

Hi,
I've managed to get a very stable network with a 4860 firewall, so I'm pretty happy.  I have two simple switches attached to the firewall, and I'm running tagged network traffic on four separate networks:

LAN - 192.168.1.0 /24  – "techie" network with linux server, printers, file share etc.
OPT1 - 192.168.2.0 /24 -- kids' gaming LAN
OPT2 - 192.168.3.0 /24 -- home devices such as TV's and media centre
OPT3 - 192.168.4.0 /24 -- wireless LAN for home and guests

Now, what I'd like to do is share a printer and a samba server that is on the LAN with users on OPT2 and OPT3.  What's the best way to do this?

Thank you in advance

[luckman212]

Should be easy, just add a few firewall rules:

interface LAN – allow traffic source OPT2 dest LAN subnet (you can do protocol "any" or specify only certain tcp/udp ports)
interface LAN -- allow traffic source OPT3 dest LAN subnet
interface OPT2 -- allow traffic from source LAN dest OPT2 subnet
interface OPT3 -- allow traffic from source LAN dest OPT3 subnet

If you need "bonjour" type printer / share discovery between the subnets, you can install the Avahi package.  But I don't recommend it, it's a bit buggy.

[c4bcons]

Great, thank you.  I will try this evening.

[c4bcons]

I though It was kind-of working, but I've got an issue getting to a Linux samba server … I'll work on that.  It must be something simple.
I've just realised that I can ping to any network, which is not what I want.  For instance, I can ping from my network 192.168.4.x to a 192.168.3.x or 192.168.2.x or 192.168.1.x  I wasn't expecting that at all.  The network masks are all 255.255.255.0, so I thought that normally I would not be able to ping unless the traffic was routed.  Is there some kind of catch-all rule on the firewall?

[johnpoz]

I have two simple switches attached to the firewall, and I'm running tagged network traffic on four separate networks:

How exactly do you have your stuff connected from a physical point of view, layer 1..  And from layer 2 point of view?  You mention tagged with simple switches?  You mean smart switches that support vlans, or dumb that do not support vlans?

I can ping from my network 192.168.4.x to a 192.168.3.x or 192.168.2.x or 192.168.1.x  I wasn't expecting that at all.

Well what are you firewall rules?  All of your traffic that uses pfsense as their gateway no matter what network they are on in your above listing would be "routed" to the other segments on pfsense.  What is allowed would depend on your firewall rules.

But from your OP, I am thinking maybe your also having an issue where your just running multiple layer 3 networks, ie your 192.168.3, 192.168.2/24 etc.. on the same layer 2.  Unless you are using different dumb switches for each network segment, and those are all on different physical interfaces on pfsense.  Unless you have "smart" switches which maybe your calling simple??  And have correctly isolated your layer 2 then yeah you could have issues with boxes talking to each other even on different networks without going through pfsense.

Can you please go over in more details how you actually have everything connected, the make and model of your switches used and how you have the vlans setup if using them.  And your firewall rules.  For smb to work your going to want tcp 445 open.  Or if talking old school smb/cifs then you could need port tcp 139..

[luckman212]

Well yes that is expected if you have a pass rule with proto "any" (which includes ICMP of course).  Make your rules more specific (e.g. for Samba you could define an Alias for ports 137-139 and 445 and then allow tcp/udp using that alias. Or if you simply want to block ping (icmp) then add some block rules for ICMP and put them at the top, above your other rules.

edit: johnpoz replied while I was typing… sorry john didn't mean to leapfrog you

[c4bcons]

Really great responses, thank you.  It's a learning thing for me, I've managed loads of network infrastructure projects, but I don't go down to this level as I have experts to do that stuff.  Very interesting.  I have a network diagram at home, I'll post the information this evening.  The switches are Netgear GS108E, I have set up tagged vlans, and the pfsense box also tags traffic.  More detail this evening.

[johnpoz]

Don't forget your firewall rules..

[c4bcons]

hopefully my attachment with the network diagram works.  It's colour coded to show the tagged vlans.
the vlan tags are here:

Interface VLAN tag Priority Description
igb0 (lan) 1 0 Home Network VLAN
igb2 (opt1) 2 Gaming Network
igb3 (opt2) 3 Home Entertainment VLAN
igb4 (opt3) 4 Wireless VLAN

pfSense
System
Interfaces
Firewall
Services
VPN
Status
Diagnostics
Gold
Help
DiagnosticsCommand Prompt
Shell Output - pfctl -sr
scrub on igb1 all fragment reassemble
scrub on igb0 all fragment reassemble
scrub on igb2 all fragment reassemble
scrub on igb3 all fragment reassemble
scrub on igb4 all fragment reassemble
anchor "relayd/" all
anchor "openvpn/" all
anchor "ipsec/" all
block drop in log quick inet from 169.254.0.0/16 to any label "Block IPv4 link-local"
block drop in log quick inet from any to 169.254.0.0/16 label "Block IPv4 link-local"
block drop in log inet all label "Default deny rule IPv4"
block drop out log inet all label "Default deny rule IPv4"
block drop in log inet6 all label "Default deny rule IPv6"
block drop out log inet6 all label "Default deny rule IPv6"
pass quick inet6 proto ipv6-icmp all icmp6-type unreach keep state
pass quick inet6 proto ipv6-icmp all icmp6-type toobig keep state
pass quick inet6 proto ipv6-icmp all icmp6-type neighbrsol keep state
pass quick inet6 proto ipv6-icmp all icmp6-type neighbradv keep state
pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type echorep keep state
pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type routersol keep state
pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type routeradv keep state
pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type neighbrsol keep state
pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type neighbradv keep state
pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type echorep keep state
pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type routersol keep state
pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type routeradv keep state
pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type neighbrsol keep state
pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type neighbradv keep state
pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type echoreq keep state
pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type routersol keep state
pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type routeradv keep state
pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type neighbrsol keep state
pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type neighbradv keep state
pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type echoreq keep state
pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type routersol keep state
pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type routeradv keep state
pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type neighbrsol keep state
pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type neighbradv keep state
pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type echoreq keep state
pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type routersol keep state
pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type routeradv keep state
pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type neighbrsol keep state
pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type neighbradv keep state
block drop log quick inet proto tcp from any port = 0 to any label "Block traffic from port 0"
block drop log quick inet proto udp from any port = 0 to any label "Block traffic from port 0"
block drop log quick inet proto tcp from any to any port = 0 label "Block traffic to port 0"
block drop log quick inet proto udp from any to any port = 0 label "Block traffic to port 0"
block drop log quick inet6 proto tcp from any port = 0 to any label "Block traffic from port 0"
block drop log quick inet6 proto udp from any port = 0 to any label "Block traffic from port 0"
block drop log quick inet6 proto tcp from any to any port = 0 label "Block traffic to port 0"
block drop log quick inet6 proto udp from any to any port = 0 label "Block traffic to port 0"
block drop log quick from <snort2c>to any label "Block snort2c hosts"
block drop log quick from any to <snort2c>label "Block snort2c hosts"
block drop in log quick proto tcp from <sshlockout>to (self) port = ssh label "sshlockout"
block drop in log quick proto tcp from <webconfiguratorlockout>to (self) port = https label "webConfiguratorlockout"
block drop in log quick from <virusprot>to any label "virusprot overload table"
pass in quick on igb1 inet6 proto udp from fe80::/10 port = dhcpv6-client to fe80::/10 port = dhcpv6-client keep state label "allow dhcpv6 client in WAN"
pass in quick on igb1 proto udp from any port = dhcpv6-server to any port = dhcpv6-client keep state label "allow dhcpv6 client in WAN"
pass out quick on igb1 proto udp from any port = dhcpv6-client to any port = dhcpv6-server keep state label "allow dhcpv6 client out WAN"
block drop in log quick on igb1 from <bogons>to any label "block bogon IPv4 networks from WAN"
block drop in log quick on igb1 from <bogonsv6>to any label "block bogon IPv6 networks from WAN"
block drop in log on ! igb1 inet from 86.23.0.0/18 to any
block drop in log inet from 86.23.57.232 to any
block drop in log on igb1 inet6 from fe80::208:a2ff:fe0a:ba33 to any
block drop in log quick on igb1 inet from 10.0.0.0/8 to any label "Block private networks from WAN block 10/8"
block drop in log quick on igb1 inet from 127.0.0.0/8 to any label "Block private networks from WAN block 127/8"
block drop in log quick on igb1 inet from 172.16.0.0/12 to any label "Block private networks from WAN block 172.16/12"
block drop in log quick on igb1 inet from 192.168.0.0/16 to any label "Block private networks from WAN block 192.168/16"
block drop in log quick on igb1 inet6 from fc00::/7 to any label "Block ULA networks from WAN block fc00::/7"
pass in on igb1 proto udp from any port = bootps to any port = bootpc keep state label "allow dhcp client out WAN"
pass out on igb1 proto udp from any port = bootpc to any port = bootps keep state label "allow dhcp client out WAN"
pass in quick on igb0 inet proto udp from any port = bootpc to 255.255.255.255 port = bootps keep state label "allow access to DHCP server"
pass in quick on igb0 inet proto udp from any port = bootpc to 192.168.1.1 port = bootps keep state label "allow access to DHCP server"
pass out quick on igb0 inet proto udp from 192.168.1.1 port = bootps to any port = bootpc keep state label "allow access to DHCP server"
pass in quick on igb2 inet proto udp from any port = bootpc to 255.255.255.255 port = bootps keep state label "allow access to DHCP server"
pass in quick on igb2 inet proto udp from any port = bootpc to 192.168.2.1 port = bootps keep state label "allow access to DHCP server"
pass out quick on igb2 inet proto udp from 192.168.2.1 port = bootps to any port = bootpc keep state label "allow access to DHCP server"
block drop in log on ! igb3 inet from 192.168.3.0/24 to any
block drop in log inet from 192.168.3.1 to any
block drop in log on igb3 inet6 from fe80::208:a2ff:fe0a:ba2f to any
pass in quick on igb3 inet proto udp from any port = bootpc to 255.255.255.255 port = bootps keep state label "allow access to DHCP server"
pass in quick on igb3 inet proto udp from any port = bootpc to 192.168.3.1 port = bootps keep state label "allow access to DHCP server"
pass out quick on igb3 inet proto udp from 192.168.3.1 port = bootps to any port = bootpc keep state label "allow access to DHCP server"
block drop in log on ! igb4 inet from 192.168.4.0/24 to any
block drop in log inet from 192.168.4.1 to any
block drop in log on igb4 inet6 from fe80::208:a2ff:fe0a:ba30 to any
pass in quick on igb4 inet proto udp from any port = bootpc to 255.255.255.255 port = bootps keep state label "allow access to DHCP server"
pass in quick on igb4 inet proto udp from any port = bootpc to 192.168.4.1 port = bootps keep state label "allow access to DHCP server"
pass out quick on igb4 inet proto udp from 192.168.4.1 port = bootps to any port = bootpc keep state label "allow access to DHCP server"
pass in on lo0 inet all flags S/SA keep state label "pass IPv4 loopback"
pass out on lo0 inet all flags S/SA keep state label "pass IPv4 loopback"
pass in on lo0 inet6 all flags S/SA keep state label "pass IPv6 loopback"
pass out on lo0 inet6 all flags S/SA keep state label "pass IPv6 loopback"
pass out inet all flags S/SA keep state allow-opts label "let out anything IPv4 from firewall host itself"
pass out inet6 all flags S/SA keep state allow-opts label "let out anything IPv6 from firewall host itself"
pass out route-to (igb1 86.23.0.1) inet from 86.23.57.232 to ! 86.23.0.0/18 flags S/SA keep state allow-opts label "let out anything from firewall host itself"
pass in quick on igb0 proto tcp from any to (igb0) port = https flags S/SA keep state label "anti-lockout rule"
pass in quick on igb0 proto tcp from any to (igb0) port = http flags S/SA keep state label "anti-lockout rule"
anchor "userrules/" all
pass in quick on igb1 reply-to (igb1 86.23.0.1) inet proto tcp all flags S/SA keep state label "USER_RULE"
pass in quick on igb0 inet from 192.168.1.0/24 to any flags S/SA keep state label "USER_RULE: Default allow LAN to any rule"
pass in quick on igb2 inet from 192.168.2.0/24 to any flags S/SA keep state label "USER_RULE"
pass in quick on igb3 inet from 192.168.3.0/24 to any flags S/SA keep state label "USER_RULE"
pass in quick on igb3 inet proto tcp all flags S/SA keep state label "USER_RULE: Allow Traffic to Admin LAN"
pass in quick on igb4 inet from 192.168.4.0/24 to any flags S/SA keep state label "USER_RULE"
anchor "tftp-proxy/*" all
Execute Shell Command

pfctl -sr</bogonsv6></bogons></virusprot></webconfiguratorlockout></sshlockout></snort2c></snort2c>

the colours in the diagram are self-explanatory LAN goes off to my office LAN, which is just a simple switch which cannot be configured.  I have set up tagged vlans on the GS switches.  Working out vlan tagging from the Netgear support documents was a headache, but I worked it out in the end.

[johnpoz]

Screenshot of your firewall rules was what I was talking about ;)

Your directly connecting your ports to different interfaces in pfsense - why are you tagging them on pfsense?  Pfsense doesn't care or need to see these tags..  While yes you need to tag them on your uplink between switches.  From your drawing putting tags on your pfsense opt interfaces is not needed, and yeah could be causing you some issues.  Pfsense only cares about the tag when when there is going to be more than one vlan on a interface.  If not there is no point to tagging.

But from these rules
pass in quick on igb2 inet from 192.168.2.0/24 to any flags S/SA keep state label "USER_RULE"
pass in quick on igb3 inet from 192.168.3.0/24 to any flags S/SA keep state label "USER_RULE"

Your doing Any Any.. So yeah you would be able to share files or print.  And to be honest with such rules other than creating new broadcast domains.  Your not firewalling anything..  Might was have everything on same network..  Guessing this is just making sure everything is working before you lock it down mode?

If your having issues with sharing files.. You running the local firewall on windows, its going to block someone coming from a different network out of the box.  You would have to allow for your other segment on the windows firewall for sharing.

[c4bcons]

@johnpoz:

Screenshot of your firewall rules was what I was talking about ;)

Your directly connecting your ports to different interfaces in pfsense - why are you tagging them on pfsense?

wasn't sure about whether you wanted a screenshot or the complete set - it took seconds for the set :)
again … I wasn't sure whether or not the pfsense had to tag the traffic, so I did it anyway :)  I'll take it away.
what I'd really like to do is keep traffic on each vlan separate, with the exception of access to the samba server, and a couple of lan connected printers.  The samba server is a Linux box with Samba running.
I don't understand the two "pass in quick ...."

[c4bcons]

I've removed the tagging from the configuration and rebooted.  The wireless LAN and the home lans seem to be working fine.  I can VPN to work over the wireless LAN.  But I can still ping from 192.168.4.x to 192.168.2.x, which I don't want to do.  And I still can't see the samba share but I can see the printers on the 192.168.1.x network.  There may be something awry with my Samba setup, so I'll check that.

[johnpoz]

You can still ping because you have ANY ANY rules!!!  Yeah your going to be able to do anything you want.. Your just routing really not firewalling with an any any rule..

You can not see your shares??  So your trying to like browse to them??  Via like your network neighborhood or something?  That is not going to work across segments.  Just access the box directly via its name or IP, ie \computername.domain.tld or \IPADDRESS

Post up your rules via a screenshot.. If you wan to be able to access your smb shares, then your going to need to allow tcp 445 if you don't want to be able to ping, then don't allow icmp, or block it before you allow any, etc.

Rules are evaluated top down, first rule to trigger wins and the rest of the rules are not looked at.  As the traffic enters interface on pfsense..  So if you don't want vlan X to talk to vlan Y on icmp..  Then on vlan X you would create rules that block icmp, or don't allow it..

[c4bcons]

Thank you johnpoz - it's like learning a new foreign language!  I will look at this later today and report back.

[johnpoz]

heheeh - yeah sure it can seem like that..

[c4bcons]

OK, so I've checked samba on the same vlan as the server and it worked first time, so something's being blocked (I guess).  If I want access samba from my wireless LAN, for instance, How do I enable tcp 445?  .. current rules are below.  The samba server is on the LAN


[c4bcons]

Hi sorry to bump this message. Can anyone tell me how to enable tcp on port 445?  I have tried to work it out but I'm really not quite sure where it's done.  Thank you

[johnpoz]

You have an ANY ANY rule - so yeah tcp 445 is open..  If you can not access the shares, then look to firewall running on where the shares are..  Out of the box windows firewall is not going to allow access to its shares from IPs other than its on local network.

[c4bcons]

Hm, thank you for the post.  I'm running Linux so there isn't a firewall running.
And I can ping the server no problem.

[johnpoz]

Linux has firewalls ;)  So you meant to say your not running one ;)

So your accessing it how \IPaddress of the samba server?  Or \hostname and its not resolving?

Your not going to be able to resolve a hostname via broadcast across segments.  So like I said before your going to have to use fqdn or ipaddress.

What does your samba.conf look like.. Do you have this other network in your hosts allow statement?  If not then no you wouldn't be able to access it.