Remove Default Route?
-
Hi Folks,
Hope you are all well. I am new to pfsense, and I am just now setting up a firewall / router to replace my basic linux router. This is an intermediate router / firewall, just to give me more granular control as I do not have access to the ISP router.
One thing I have in place currently, which I really like, is that I don't have a default route on my linux router. I have explicit routes for the networks which I need to route between, but then with no default route, this means that any direct attempts to connect out to any other destination, will fail by definition. There is no route in the networks upstream in any case, which would allow such general traffic to progress, however this approach just gives me one more, 'blunt hammer' piece of protection.
From setting up pfsense, my LAN gateway is also defined as 'default gateway'. I still have my specific routes defined, but this means that at least the routing side would attempt to forward other traffic (such as a trojan attempting to 'get out' directly). I realise that I can just build appropriate rules to only allow specific traffic out, on the firewalling side, but I just wondered - is there any way on the routing side in pfsense, to achieve what I currently have? ie use all defined routes, but have no default route?
Many thanks for your time.
-
On System / Routing / Gateways it appears you can delete a gateway. Try that.
-
On System / Routing / Gateways it appears you can delete a gateway. Try that.
It is not possible to delete Gateways. Just another silly bug… :o
-
The firewall should always have a default route out or things like the update check, packages, etc, will fail. DNS Resolution will also fail unless you make sure it can only talk to DNS servers you have a route to.
That said, you can delete gateways so long as they are static. If you have a dynamic interface such as DHCP or PPPoE, those will always have the gateways given to them by the upstream service and those cannot be removed or deactivated. To remove a static gateway, you will also need to remove it from the interface first if it's there. So for example, go to Interfaces > WAN, set the gateway to none, save, apply, then go to System > Routing and remove it.
