Cant ping my gateway on op1 interface, but can access pfsense web….

[doktornotor]

Sigh.

• The first rule on LAN is useless.
  -  The 172. rules on LAN have no effect, that's not where you put them
  -  The first rule on OPT1 makes no sense either, it's already covered by the second one.
• DNS is UDP/TCP, not TCP.
• Ping is ICMP, not TCP.

[johnpoz]

Pretty much none of those rules makes sense on lan since you have an any any on the bottom and that source of 172.29 would never be seen inbound into lan unless you had a downstream router and lan was your transit network.

Your rules on opt are pointless as well, as dok pints out dns is UDP, with now and then some possible tcp..

And where in those rules do you allow ICMP or Any your 2nd rule is any any for tcp only - ping is icmp.

https://doc.pfsense.org/index.php/Firewall_Rule_Basics

Firewall rules on Interface and Group tabs process traffic in the Inbound direction and are processed from the top down, stopping at the first match. Where no user-configured firewall rules match, traffic is denied.

Maybe this should be worded better? Maybe we need to put in pictures??

[1keystorke]

Okey I removed them, but still no changes


[1keystorke]

1

[doktornotor]

I cannot see anything removed or improved, plus you are missing the absolutely basic rule: you do NOT allow OPT1 traffic on LAN. You allow it on OPT1 (the interfaces where the traffic first hits the firewall)

[johnpoz]

yeah looks like you got this .6 wanting to talk to googledns.. Going to be hard for it resolve local stuff that way ;)

What I would highly suggest is put in any any rule on Opt1, get your stuff talking!!  Then put in block rules for what you don't want to talk.. Unless you don't want opt talking to lan at all?

[1keystorke]

update of rules


[1keystorke]

updated opt1


[johnpoz]

And again completely pointless with that TCP rule with a rule right below it that says any any..  You do not need this rule!!!  Unless you wanted to log or something - which you clearly do not have marked.

And you rule on opt is only allow TCP, not ping (icmp) or dns which is UDP..

[doktornotor]

The first rule is still pointless. But yet again: You are showing us the WRONG INTERFACE!!!

You need to allow the traffic on OPT1, NOT LAN!!!!

[1keystorke]

Okey god… I am such an idiot............ Figured it out now........ God dam.......

[1keystorke]

thanks guys for sticking it out…. I am such a freaking dumb ass.....

[doktornotor]

Well no problem, you figured out the issue pretty fast. Some people don't get it even after a couple of days. :D

[1keystorke]

I felt so freaking dumb when I discovered what I had done worng. But again thaks for helping me in my less bright moments :P

[johnpoz]

Days?  heheh dok there are some that don't get it after weeks ;) heheheh