Invert match doesn't work

[Qinn]

In the rules I have (see attachment), with the last rule, I grant the guests to access anything anywhere, so at that point, I throw out the default rule that everything is blocked. IMHO it would be better, when there is a default rule that block you to go anywhere, not to through this away at the last rule.

@johnpoz:

Huh??  Any firewall out there the default is always deny.. Unless your talking some off the shelf router designed for users on 1 flat network and pretty much all it does is NAT.

Out of the box this is how pfsense will act for the 1st network "lan" buy creating a any any rule.  But if you create new networks you would have to put in the rules you want.  But the internet is made up of lots of networks..As stated pretty much any IP that does not fall to rfc1918 is internet.. Other than some other special networks and the few that have not been assigned, etc.  But in general if not rfc1918 space its the "internet"

There are many protocols on the internet not just tcp, udp and icmp..  You never know what exactly a client behind pfsense will need to go and do.. So if you want to allow internet its general you create a any any rule.  You can always limit that how you see fit.

How exactly would you create dest that was "internet"??  It really could be anything.

Maybe it's stupid qeustion, but to me it would seem logical that if I would create a pass rule from Guest net to WAN net, it would give internet access to the guests. Than one rule would be enough, as everything else will be blocked by the default rule.

[GruensFroeschli]

@Qinn:

In the rules I have (see attachment), with the last rule, I grant the guests to access anything anywhere, so at that point, I throw out the default rule that everything is blocked. IMHO it would be better, when there is a default rule that block you to go anywhere, not to through this away at the last rule.

@johnpoz:

Huh??  Any firewall out there the default is always deny.. Unless your talking some off the shelf router designed for users on 1 flat network and pretty much all it does is NAT.

Out of the box this is how pfsense will act for the 1st network "lan" buy creating a any any rule.  But if you create new networks you would have to put in the rules you want.  But the internet is made up of lots of networks..As stated pretty much any IP that does not fall to rfc1918 is internet.. Other than some other special networks and the few that have not been assigned, etc.  But in general if not rfc1918 space its the "internet"

There are many protocols on the internet not just tcp, udp and icmp..  You never know what exactly a client behind pfsense will need to go and do.. So if you want to allow internet its general you create a any any rule.  You can always limit that how you see fit.

How exactly would you create dest that was "internet"??  It really could be anything.

Maybe it's stupid qeustion, but to me it would seem logical that if I would create a pass rule from Guest net to WAN net, it would give internet access to the guests. Than one rule would be enough, as everything else will be blocked by the default rule.

The guest net is the network attached to the guest interface.
The WAN net is the network attached to the WAN interface.
–> Not the internet.

[Qinn]

@GruensFroeschli:

The guest net is the network attached to the guest interface.
The WAN net is the network attached to the WAN interface.
–> Not the internet.

–-> Not the internet :o , do you mean the ISP and where is it (meaning the internet) then connected to?

[GruensFroeschli]

The internet is mostly the inverse of RFC1918:
All subnets which are not private.
There are some other special cases like RFC3927 (169.254/16)
Take a look at https://en.wikipedia.org/wiki/IPv4#Special-use_addresses.

When you create a rule with as destination "WAN net" then it means exactly that:
The network between you and your ISP.
Generally not what you want.

When you mean "the internet", you usually mean "any".

[kpa]

The WAN network is the directly connected network segment that is reachable from the WAN interface via ARP (hosts that are in the same broadcast domain talk to each other with the assistance of ARP), that's the simplest way to put it. In other words connections to that network segment from the WAN interface on pfSense can be done without the assistance of the gateway (the default gateway of pfSense) on the WAN network.

You have to grasp what a connection means in internet terms. It's simply one or more IP packets sent from sending host to a destination address and the destination address in the IP packets (also source address if desired) is what pfSense uses for filtering. What is used as the transport (routers etc.) between the sending host and the destination address doesn't matter for the firewall rules, that information is not available for filtering on pfSense, all filtering is done based on the information available in the IP headers of the IP packets flowing trough the filtering engine.

[Qinn]

Aha, thanks to you both for explaining that to me, the concept WAN not being Internet was never clear to me.

[Qinn]

Back on topic, I still don't understand what is wrong (as I can't believe inverted rule are broken).
I added my rule set on the WLAN interface and have logging enabled first with the inverted rule enabled and the log file that confirms a user passing from WLAN to LAN (192.168.5.46 to 192.168.1.1), which I do not understand and to the best of my knowledge should be possible with the inverted rule enabled.
Then just as a check I disable the inverted rule and as you can see access to the LAN is blocked?

Again thanks for any help advise on this,

Cheers Qinn


[Derelict]

OK do this.

Replace that ! rule on WLAN with two rules:

One that blocks traffic from WLAN Net to LAN net

Followed by:

One that passes traffic from LAN WLAN net to any.

Does it work now?

[Qinn]

@Derelict:

OK do this.

Replace that ! rule on WLAN with two rules:

One that blocks traffic from WLAN Net to LAN net

Followed by:

One that passes traffic from LAN net to any.

Does it work now?

I think that were you wrote the pass from LAN, you meant it WLAN instead…
Well I did that any it works as it should, reading from the logs. To the best of my knowledge you replaced the inverted rule by 2 seperate rules and this works  :o


[johnpoz]

What is the actual lan net?  Lets see how you have that setup.. And what is the actual address of lan?

Please post all you rules with this command.

https://doc.pfsense.org/index.php/How_can_I_see_the_full_PF_ruleset

So you have any vips setup?

[Qinn]

Thanks johnpoz, I will report back asap (later this evening).

[johnpoz]

Here.. My wlan is secured wifi network.  With a few wired hosts on it.. To get on the wireless you have to have a cert it uses eap-tls to auth.  Anyhow - so its a trusted network and I allow it do anything it wants so any any rule.

So the wlan network is 192.168.2/24 with pfsense being 192.168.2.253
Lan is 192.168.9/24 with pfsense having 192.168.9.253

So on a client on the wlan network you can see 192.168.2.11, with first set of rules I can ping pfsense lan IP at 192.168.9.253

I then change the any any rule to be ! lan net, as you can then see from 2nd ping that I can not get there with 11 lost packets when I try and ping.  So clearly you got something ODD going on there there.. A listing of your full rules when you have the ! lan net rule in play will help us track down what that oddness is.  Do you have any vips setup on wlan or lan?  Are you doing policy routing anywhere?  Do you have the disable neg rules set in advanced (firewall&nat)

Disable Negate rules
Disable Negate rule on policy routing rules With Multi-WAN it is generally desired to ensure traffic reaches directly connected networks and VPN networks when using policy routing. This can be disabled for special purposes but it requires manually creating rules for these networks.

[Derelict]

I think that were you wrote the pass from LAN, you meant it WLAN instead…

Yeah sorry.

To the best of my knowledge you replaced the inverted rule by 2 seperate rules and this works  :o

Amazing. Don't "block" traffic with inverted pass rules. Not sure how many times I have to say it. If it saves just one rule set it's worth it.

[johnpoz]

Then what is the point of the inverted rules Derelict?

It should work, there is something odd with his system why its not.

And its not blocking traffic with an allow… Is a specific allow, the block happens with the default deny at the end..

[Derelict]

@johnpoz:

Then what is the point of the inverted rules Derelict?

It should work, there is something odd with his system why its not.

And its not blocking traffic with an allow… Is a specific allow, the block happens with the default deny at the end..

Why are they there? That's a really good question.

You have seen what pf does with that kind of rule in certain cases in that filed bug. I am not going to explain it again.

If you want to block traffic, then BLOCK IT!

He makes a rule with a pass ! net. It doesn't work. Does the same thing with a block then pass rule. It works… Again. And will. In ALL CASES!

People are just plain lazy.

OP, just PM the contents of /tmp/rules.debug and I'll tell you why it's not working.  That is, a copy of the rule set with the broken invert match rule, not with the (arguably-proper) rule set that isn't broken.

[Qinn]

@johnpoz:

Then what is the point of the inverted rules Derelict?

It should work, there is something odd with his system why its not.

And its not blocking traffic with an allow… Is a specific allow, the block happens with the default deny at the end..

@johnpoz I am still looking for the what and why on this inverted rule, as @Derelict has an explanation for it, I first await his answer before posting the file you suggested,  I hope this doesn't offend you.

[Qinn]

rules WLAN


[johnpoz]

Did you send him the rules? in a PM?

Don't get me wrong, me and Derelict go round and round this topic all the time ;)  And there has been bug reports filed, etc.  If you have a vip in a different network you can have some weirdness for example.

And I do understand his point about explicit blocking..  But this method of saying you can go everywhere but here is also valid rule syntax.. It is an explicit allow… Allow rules are also suppose to function..

Blocking all traffic that is not allowed is valid way to run a firewall.. You should not have to do a explicit deny when the default deny should cover you, etc.

So yes I am very interested in why in your setup it is not working as it should.

The one thing everyone should always remember is to actually validate a rule set before assuming it will function how you think it will..  To catch something that isn't obvious to the human eye.

[Qinn]

@johnpoz:

Did you send him the rules? in a PM?

Don't get me wrong, me and Derelict go round and round this topic all the time ;)  And there has been bug reports filed, etc.  If you have a vip in a different network you can have some weirdness for example.

And I do understand his point about explicit blocking..  But this method of saying you can go everywhere but here is also valid rule syntax.. It is an explicit allow… Allow rules are also suppose to function..

Blocking all traffic that is not allowed is valid way to run a firewall.. You should not have to do a explicit deny when the default deny should cover you, etc.

So yes I am very interested in why in your setup it is not working as it should.

The one thing everyone should always remember is to actually validate a rule set before assuming it will function how you think it will..  To catch something that isn't obvious to the human eye.

Good to know I send him the the rules.debug and hope to get an answer.

[Qinn]

@johnpoz:

Did you send him the rules? in a PM?

The rules I have posted in Reply #44, are because I cannot PM files/pictures (or at least I couldn't accomplish it), so I posted it  in this thread.