Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfSense Firewall Rules

    Scheduled Pinned Locked Moved Firewalling
    21 Posts 3 Posters 2.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • 1
      19Giugno
      last edited by

      Kom, this is what I added to the DNS Resolver:

      Host Overrides
      bo-temp xxxx.com 192.168.22.3 DNS

      Still not working. If I ping 192.168.22.3 from my machine connected to the VPN, I get a response. If I ping bo-temp.xxxx.com it resolves with the network public IP address.

      GrimsonG 1 Reply Last reply Reply Quote 0
      • KOMK
        KOM
        last edited by

        This should be easy. You should be able to access your internal web server via the VPN without any magic. Let's start simple: Can you access it via its LAN IP address? eg http://192.168.22.3/?

        1 1 Reply Last reply Reply Quote 0
        • GrimsonG
          Grimson Banned @19Giugno
          last edited by

          @19giugno said in pfSense Firewall Rules:

          Still not working. If I ping 192.168.22.3 from my machine connected to the VPN, I get a response. If I ping bo-temp.xxxx.com it resolves with the network public IP address.

          So what DNS is your machine using? For the DNS overrides to work it obviously has to use the DNS resolver/forwarder from the pfSense instance where the override is configured.

          1 1 Reply Last reply Reply Quote 0
          • 1
            19Giugno @KOM
            last edited by

            @kom said in pfSense Firewall Rules:

            http://192.168.22.3/?

            Yes I can.

            1 Reply Last reply Reply Quote 0
            • 1
              19Giugno @Grimson
              last edited by

              @grimson said in pfSense Firewall Rules:

              @19giugno said in pfSense Firewall Rules:

              Still not working. If I ping 192.168.22.3 from my machine connected to the VPN, I get a response. If I ping bo-temp.xxxx.com it resolves with the network public IP address.

              So what DNS is your machine using? For the DNS overrides to work it obviously has to use the DNS resolver/forwarder from the pfSense instance where the override is configured.

              Hi Grimson,
              I am using assigned DNS (Obtain DNS server address automatically). I am not sure how to check if I am using the DNS resolver/forwarder? And how I can be sure to use it?

              1 Reply Last reply Reply Quote 0
              • KOMK
                KOM
                last edited by

                OK so your problem is DNS-related. Status - Services will tell you if you're using Forwarder (dnsmasq) or Resolver (unbound). Or you could go to Services - DNS Forwarder and see if it's enabled, likewise for Services - DNS Resolver.

                It looks to me like you don't have your OpenVPN config quite right. In your config under Advanced Client Settings, are you pushing pfSense DNS to your VPN clients?

                1 Reply Last reply Reply Quote 0
                • 1
                  19Giugno
                  last edited by

                  Hi KOM,
                  DNS Resolver is enabled, DNS Forwarder is not.

                  In OperVPN, Advanced Client Settings there is nothing enabled.

                  Thanks.

                  1 1 Reply Last reply Reply Quote 0
                  • KOMK
                    KOM
                    last edited by

                    So then try checking the DNS Server Enable box and then add your pfSense LAN IP address as DNS Server 1.

                    1 Reply Last reply Reply Quote 0
                    • 1
                      19Giugno @19Giugno
                      last edited by

                      @19giugno said in pfSense Firewall Rules:

                      Hi KOM,
                      DNS Resolver is enabled, DNS Forwarder is not.

                      In OperVPN, Advanced Client Settings there is nothing enabled.

                      Thanks.

                      Yes! That worked! It works now. Thank you so much!

                      I got another question now, if the answer is yes I will open a new thread: is it possible to have whitelist specific for websites? I mean, on the web server I have website A and website B. Can I define an alias to access only website A and another one website B?

                      1 Reply Last reply Reply Quote 0
                      • KOMK
                        KOM
                        last edited by

                        Of course. You can specify the Source for any NAT you create. Create an alias for your whitelist and then use it as the Source in your NAT rule.

                        1 Reply Last reply Reply Quote 0
                        • 1
                          19Giugno
                          last edited by

                          Thanks KOM for your help and your patience.

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.