Configure 3 lan in pfsense
-
For this example, let's say your lans are called LAN, LAN2, and LAN3.
You need to add firewall rules for each of the interfaces, whether they be physical or virtual. This 1 simple rule (for IPv4 or IPv6) will allow traffic to pass to the internet (out thru your default gateway). The rule is as follows (sorry, it's an old version of pfsense, but still applies):
During your initial setup, on whatever interface you pick as LAN, these rules are auto-created. You can recreate them, or duplicate them, for your other interfaces very easily. But, they have to be there, or no traffic moves out of that particular network.
And, since we're talking about making firewall rules, here's a good summary on what all the terms mean in the "source" and "destination" drop down menus. If you're wondering...
https://docs.netgate.com/pfsense/en/latest/firewall/firewall-rule-basics.html
Finally, you might need to reboot the pfsense box after you fiddle with all these settings. It never hurts.
Hope that helps!
By the way, I don't use squidguard, so I can't comment on how that might be affecting this problem, or not.
Jeff
-
@akuma1x thank you, I could already with 2 lan !!!
-
@akuma1x sure hope you pulled that picture from somewhere... That is OLD... your not running that version of pfsense are you?
-
@johnpoz No, I'm running current 2.4.4p2 on all my gear.
But, when I went to search for an image of the default LAN rules, it only shows old pfsense versions, apparently. Try it, do a search for "pfsense default lan rules" and check the images that it finds. I was only looking for the 2 default rules, nothing additional. So, I simply posted what I found.
I should have just screenshot'ted my own setup, but I've got some extra rules on my LAN interface besides default stuff.
Jeff
-
quick google found this ;)
But yeah lots of OLD stuff comes up as well ;)
-
@johnpoz I did it like that jejej the version is 2.4.4 thank you !!
-
@johnpoz doh, look at that! Picture option number 2, my bad...
Jeff
-
@akuma1x It is only configured there for internet access, because it does not have internet access anymore, mmm something is wrong here :o :( Thanks for your help
-
Do you have Squid set to listen on those new interfaces?
Steve
-
@stephenw10 I did it like that
-
Hmm, OK do you see hits in the squid access log from clients on all 3 interfaces?
If so the Squidguard ACLs are probably not set for all three subnets as sources.
Steve
-
@stephenw10 And why does not squidguard block the list that I have assigned :( ?? and how do I configure that?
-
See my last question ^. Is squid showing it's proxying that traffic?
Is Squidguard configured to filter traffic from all three subnets?
Steve
-
@stephenw10 Yes I do it
-
-
Your group ACL there only contains 15 IPs. Is that the group that should be allowed access to any site?
What targets do you have set there?
What do you have in the Common ACLs?
Do you actually see traffic from all three subnet in the Squid RealTime logs to show they are all being proxied?
Steve
-
@stephenw10 Your group ACL there only contains 15 IPs. Is that the group that should be allowed access to any site? R: That group of ips should be restricted some content and enable all
What targets do you have set there? R: I have a blacklist where I added the domains to block
What do you have in the Common ACLs? R: I deny the black list that I just created for the group of ips and I allow everything else
Do you actually see traffic from all three subnets in the Squid RealTime logs to show they are all being proxied? R: yes i have access logs
-
Ok, well if that's your blocked clients list do you have group ACLs for each subnet? That;s just one subnet listed there so it would not catch traffic from the other interfaces.
Is that one you have shown working?
Steve
-
@stephenw10 Ok, well if that's your block clients list do you have group ACLs for each subnet? R: Yes, for each one
Is that one you have shown working? R: Yes it is the one that works well
So how could I do it so that if I accept the block list? :O -
I don't understand the question.
If traffic from the other subnets is not being filtered then it is probably not matching the group ACLs for those interfaces. Check they are correct.
Steve
