Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Invert match doesn't work

    Scheduled Pinned Locked Moved Firewalling
    55 Posts 7 Posters 12.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • QinnQ
      Qinn
      last edited by

      @johnpoz:

      rfc1918 alias I created.. So this allows access to internet but blocks all access to any of my other vlans which are all in rfc1918 space.

      Could you give an example of this? I have 7 VLAN's and it's a lot of work to block everyone manually?

      Cheers Qinn

      Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
      Firmware: Latest-stable-pfSense CE (amd64)
      Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

      1 Reply Last reply Reply Quote 0
      • GruensFroeschliG
        GruensFroeschli
        last edited by

        Create an alias.
        Add the subnets
        192.168/16
        172.16/12
        10/8
        Call the alias RFC1918

        We do what we must, because we can.

        Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          ^yup that is what I have exactly

          rfc1918.png
          rfc1918.png_thumb

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • QinnQ
            Qinn
            last edited by

            Thanks to you both!!

            Could you show me an example how to in the rules?

            Cheers Qinn

            Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
            Firmware: Latest-stable-pfSense CE (amd64)
            Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

            1 Reply Last reply Reply Quote 0
            • QinnQ
              Qinn
              last edited by

              @johnpoz:

              ^yup that is what I have exactly

              I now have this, I have only allowed port 53 on the gateway, this seems enough. Maybe a stupid question, but why don't it need an open port on dhcp, orto rephrase that why does it get an IP address?

              pf-002.png_thumb
              pf-002.png

              Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
              Firmware: Latest-stable-pfSense CE (amd64)
              Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                When you enable dhcp server, pfsense creates rules that are not shown in the gui.  There are a few rules like this.

                Here is the thing if they didn't auto create the dhcp rules - every other day there would be a question about dhcp not working.. Did you create the firewall rules, lets see them because 999.99999 out of 100 you did it wrong ;)

                If you are wanting to block guests to all things yours.  Is your wan public or rfc1918?  Since your guest could hit your gui via the wan IP coming from the "lan" side like they are..  This is the good use of "this firewall" built in alias.  This is any IP the firewall has.

                I personally would allow ping to the pfsense address, so you can validate your guest can talk to pfsense.. And you sure you want guest to only have tcp outbound?  So you don't want them to be able to ping anything out on the internet or use udp?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • QinnQ
                  Qinn
                  last edited by

                  @johnpoz:

                  When you enable dhcp server, pfsense creates rules that are not shown in the gui.  There are a few rules like this.

                  Here is the thing if they didn't auto create the dhcp rules - every other day there would be a question about dhcp not working.. Did you create the firewall rules, lets see them because 999.99999 out of 100 you did it wrong ;)

                  If you are wanting to block guests to all things yours.  Is your wan public or rfc1918?  Since your guest could hit your gui via the wan IP coming from the "lan" side like they are..  This is the good use of "this firewall" built in alias.  This is any IP the firewall has.

                  I personally would allow ping to the pfsense address, so you can validate your guest can talk to pfsense.. And you sure you want guest to only have tcp outbound?  So you don't want them to be able to ping anything out on the internet or use udp?

                  Aha, I did not know that about port 67 (DHCP), it seems logic.

                  I don't understand what you mean here  "Is your wan public or rfc1918?" could you explain a bit more? Although, I don't understand it Yet, I think I have added that rule, I choose a reject or would you advise a block?

                  pf-003.png
                  pf-003.png_thumb

                  Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                  Firmware: Latest-stable-pfSense CE (amd64)
                  Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    "Is your wan public or rfc1918?" could you explain a bit more?"

                    Huh?  How is it you just created a alias for rfc1918 space but you do not know what it is?

                    If your wan starts with 10.x or 172.16-31.x or 192.168.x then its rfc1918 and your alias rule would block all access.  If it was public say 62.14.45.x then your rule would not block it and your allow on the bottom would users hit your wan IP, ie the gui or ssh etc. from this network.

                    Rules are evaluated at they enter a interface, top down first rule to trigger wins, no other rules are evaluated.  So while default on wan is deny - that is when your coming from the WAN direction towards pfsense.  If your behind pfsense you can hit that IP all day long on any service listening on it.  This is where the "this firewall" rule alias comes in handy.  For example maybe you want opt1 net to go to your lan net to get to stuff.  But you don't want opt1 net to be able to get to the web gui on the lan IP..

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      That rule will not block access to the internet even if the WAN is RFC1918-addressed. It would block access to the things on WAN net like the ISP gateway in that case.

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • QinnQ
                        Qinn
                        last edited by

                        @johnpoz:

                        "Is your wan public or rfc1918?" could you explain a bit more?"

                        Huh?  How is it you just created a alias for rfc1918 space but you do not know what it is?

                        Well I know what RFC1918 means (private subnets), but I don't understand that a WAN could be part of that? To my best of my knowledge, WAN always means not private subnet. So I hope you can provide me with an practical example so I can understand it.

                        I also still don't understand that my xDSL modem has a RFC1980 address and is accessible as it is on the WAN side, but it works.

                        LAN–--------------WAN---------------xDSLModem (Draytek 130 in PPPoA to PPPoE bridge mode)
                        192.168.1.x      83.161.x.x          192.168.100.1

                        Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                        Firmware: Latest-stable-pfSense CE (amd64)
                        Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                        1 Reply Last reply Reply Quote 0
                        • QinnQ
                          Qinn
                          last edited by

                          @Derelict:

                          That rule will not block access to the internet even if the WAN is RFC1918-addressed. It would block access to the things on WAN net like the ISP gateway in that case.

                          Hmmm, trying to grasp that one…

                          Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                          Firmware: Latest-stable-pfSense CE (amd64)
                          Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                          1 Reply Last reply Reply Quote 0
                          • bingo600B
                            bingo600
                            last edited by

                            That rule will only block packets that has a destination matching a RFC1918 address.
                            The internet is "everything but RFC1918" , so no destination match.

                            Rules matches an (end) destination.

                            /Bingo

                            If you find my answer useful - Please give the post a 👍 - "thumbs up"

                            pfSense+ 23.05.1 (ZFS)

                            QOTOM-Q355G4 Quad Lan.
                            CPU  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                            LAN  : 4 x Intel 211, Disk  : 240G SAMSUNG MZ7L3240HCHQ SSD

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              "WAN always means not private subnet"

                              Wan is just something that is not local to you - ie the internet is a wan, your wan side connection to the internet is just your transit network to networks other than your local networks.

                              There are many reasons why your wan IP could be rfc1918.. your ISP is doing carrier grade nat.  Your behind your isp router that does not allow bridge mode and so your behind a double nat.  Pfsense is just a downstream router in a larger network, etc..

                              My point was if you don't want users on that network to be able to get to web gui, you would need to block your wan IP if it was public - if your wan was rfc1918 then your rule would block that access as well.

                              Seems users have a real problem with what a wan actually is - all your wan network is the transit network to networks that are not your..  Putting rules like blocking access or allowing access to wan net is just that that actual network be it some rfc1918 because your behind a nat router or carrier grade nat or be a public segment that can route on the network and is just some segment off the ISP network, etc.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • QinnQ
                                Qinn
                                last edited by

                                @bingo600:

                                That rule will only block packets that has a destination matching a RFC1918 address.
                                The internet is "everything but RFC1918" , so no destination match.

                                Rules matches an (end) destination.

                                /Bingo

                                Thanks!

                                Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                                Firmware: Latest-stable-pfSense CE (amd64)
                                Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                                1 Reply Last reply Reply Quote 0
                                • QinnQ
                                  Qinn
                                  last edited by

                                  @johnpoz:

                                  "WAN always means not private subnet"

                                  Wan is just something that is not local to you - ie the internet is a wan, your wan side connection to the internet is just your transit network to networks other than your local networks.

                                  There are many reasons why your wan IP could be rfc1918.. your ISP is doing carrier grade nat.  Your behind your isp router that does not allow bridge mode and so your behind a double nat.  Pfsense is just a downstream router in a larger network, etc..

                                  My point was if you don't want users on that network to be able to get to web gui, you would need to block your wan IP if it was public - if your wan was rfc1918 then your rule would block that access as well.

                                  Seems users have a real problem with what a wan actually is - all your wan network is the transit network to networks that are not your..  Putting rules like blocking access or allowing access to wan net is just that that actual network be it some rfc1918 because your behind a nat router or carrier grade nat or be a public segment that can route on the network and is just some segment off the ISP network, etc.

                                  Thanks, for explaining it!

                                  What I also would like to know is, why does anyone who only wants to, lets say guests, give access to the internet, do it like, block everything and as a last rule grant access to everywhere.

                                  Why not, as in pfSense by default everything is blocked (apart from port 67 DHCP), only grant access to the internet?

                                  Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                                  Firmware: Latest-stable-pfSense CE (amd64)
                                  Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by

                                    Huh??  Any firewall out there the default is always deny.. Unless your talking some off the shelf router designed for users on 1 flat network and pretty much all it does is NAT.

                                    Out of the box this is how pfsense will act for the 1st network "lan" buy creating a any any rule.  But if you create new networks you would have to put in the rules you want.  But the internet is made up of lots of networks.. As stated pretty much any IP that does not fall to rfc1918 is internet.. Other than some other special networks and the few that have not been assigned, etc.  But in general if not rfc1918 space its the "internet"

                                    There are many protocols on the internet not just tcp, udp and icmp..  You never know what exactly a client behind pfsense will need to go and do.. So if you want to allow internet its general you create a any any rule.  You can always limit that how you see fit.

                                    How exactly would you create dest that was "internet"??  It really could be anything.

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • QinnQ
                                      Qinn
                                      last edited by

                                      In the rules I have (see attachment), with the last rule, I grant the guests to access anything anywhere, so at that point, I throw out the default rule that everything is blocked. IMHO it would be better, when there is a default rule that block you to go anywhere, not to through this away at the last rule.

                                      @johnpoz:

                                      Huh??  Any firewall out there the default is always deny.. Unless your talking some off the shelf router designed for users on 1 flat network and pretty much all it does is NAT.

                                      Out of the box this is how pfsense will act for the 1st network "lan" buy creating a any any rule.  But if you create new networks you would have to put in the rules you want.  But the internet is made up of lots of networks..As stated pretty much any IP that does not fall to rfc1918 is internet.. Other than some other special networks and the few that have not been assigned, etc.  But in general if not rfc1918 space its the "internet"

                                      There are many protocols on the internet not just tcp, udp and icmp..  You never know what exactly a client behind pfsense will need to go and do.. So if you want to allow internet its general you create a any any rule.  You can always limit that how you see fit.

                                      How exactly would you create dest that was "internet"??  It really could be anything.

                                      Maybe it's stupid qeustion, but to me it would seem logical that if I would create a pass rule from Guest net to WAN net, it would give internet access to the guests. Than one rule would be enough, as everything else will be blocked by the default rule.

                                      pf-003.png
                                      pf-003.png_thumb

                                      Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                                      Firmware: Latest-stable-pfSense CE (amd64)
                                      Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                                      1 Reply Last reply Reply Quote 0
                                      • GruensFroeschliG
                                        GruensFroeschli
                                        last edited by

                                        @Qinn:

                                        In the rules I have (see attachment), with the last rule, I grant the guests to access anything anywhere, so at that point, I throw out the default rule that everything is blocked. IMHO it would be better, when there is a default rule that block you to go anywhere, not to through this away at the last rule.

                                        @johnpoz:

                                        Huh??  Any firewall out there the default is always deny.. Unless your talking some off the shelf router designed for users on 1 flat network and pretty much all it does is NAT.

                                        Out of the box this is how pfsense will act for the 1st network "lan" buy creating a any any rule.  But if you create new networks you would have to put in the rules you want.  But the internet is made up of lots of networks..As stated pretty much any IP that does not fall to rfc1918 is internet.. Other than some other special networks and the few that have not been assigned, etc.  But in general if not rfc1918 space its the "internet"

                                        There are many protocols on the internet not just tcp, udp and icmp..  You never know what exactly a client behind pfsense will need to go and do.. So if you want to allow internet its general you create a any any rule.  You can always limit that how you see fit.

                                        How exactly would you create dest that was "internet"??  It really could be anything.

                                        Maybe it's stupid qeustion, but to me it would seem logical that if I would create a pass rule from Guest net to WAN net, it would give internet access to the guests. Than one rule would be enough, as everything else will be blocked by the default rule.

                                        The guest net is the network attached to the guest interface.
                                        The WAN net is the network attached to the WAN interface.
                                        –> Not the internet.

                                        We do what we must, because we can.

                                        Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                                        1 Reply Last reply Reply Quote 0
                                        • QinnQ
                                          Qinn
                                          last edited by

                                          @GruensFroeschli:

                                          The guest net is the network attached to the guest interface.
                                          The WAN net is the network attached to the WAN interface.
                                          –> Not the internet.

                                          –-> Not the internet :o , do you mean the ISP and where is it (meaning the internet) then connected to?

                                          Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                                          Firmware: Latest-stable-pfSense CE (amd64)
                                          Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                                          1 Reply Last reply Reply Quote 0
                                          • GruensFroeschliG
                                            GruensFroeschli
                                            last edited by

                                            The internet is mostly the inverse of RFC1918:
                                            All subnets which are not private.
                                            There are some other special cases like RFC3927 (169.254/16)
                                            Take a look at https://en.wikipedia.org/wiki/IPv4#Special-use_addresses.

                                            When you create a rule with as destination "WAN net" then it means exactly that:
                                            The network between you and your ISP.
                                            Generally not what you want.

                                            When you mean "the internet", you usually mean "any".

                                            We do what we must, because we can.

                                            Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.