• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

New User to pfSense - some doubts

General pfSense Questions
9
96
18.7k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • H
    HansSolo
    last edited by May 1, 2019, 12:00 PM

    For anyone who comes to this thread later......

    At least in pfsense 2.4.4, here is how you can look at your pfSenseBlockerNG files and see ALL the IP addresses in any given file....

    In the WebConfiguration console, go to --> DIAGNOSTICS --> EDIT FILES

    There you get a graphical Directory listing of the entire PfSense system (it's a Linux system)

    The pfb_NAmerica file for example is located here.....(click on it and it will open in a text editor)

    /var/db/pfblockerng/original/pfB_NAmerica_v4.orig

    1 Reply Last reply Reply Quote 0
    • H
      HansSolo @johnpoz
      last edited by May 1, 2019, 12:03 PM

      @johnpoz said in New User to pfSense - some doubts:

      @HansSolo said in New User to pfSense - some doubts:

      Can you let me know if you STILL believe these rules are in error?

      An any any rule on your wan is NEVER going to be a good thing to be honest.. be it you lock down the source in some way or not..

      I agree....

      So are you also agreeing that pfSenseBlockerNG has incorrectly configured their settings?

      Because once again, what you see in the diagram above is created during the install of pfsenseblockNG and I did not configure those rules.

      J 1 Reply Last reply May 1, 2019, 12:07 PM Reply Quote 0
      • S
        stephenw10 Netgate Administrator
        last edited by stephenw10 May 1, 2019, 12:05 PM May 1, 2019, 12:03 PM

        Yes, you should change those rules.

        As I said, if I were doing it I would set pfBlocker to create aliases only, not add rules. Then add the rules I need separately using those aliases.

        pfBlocker only does what you configure it to do and looks like you configured it so add inbound pass rules. That is almost certainly not what you wanted. At least not without a destination/port.

        Steve

        H 1 Reply Last reply May 1, 2019, 12:13 PM Reply Quote 0
        • J
          johnpoz LAYER 8 Global Moderator @HansSolo
          last edited by May 1, 2019, 12:07 PM

          @HansSolo said in New User to pfSense - some doubts:

          So are you also agreeing that pfSenseBlockerNG has incorrectly configured their settings?

          NO!!! I just ran through the wizard and it didn't create single rule on my WAN!!

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

          H C 2 Replies Last reply May 1, 2019, 12:15 PM Reply Quote 0
          • H
            HansSolo @stephenw10
            last edited by May 1, 2019, 12:13 PM

            There seems to be some confusion floating here, so I'm posting a screen shot of the rule that everal keep saying I need to change.

            Here is the configuration for the rule in question for pfSenseBlockerNG.
            As you can see, it is not like a regular rule configuration screen and does not allow for the changes being suggested.....
            There is nowhere to change PORTS....and the destination could be changed to the IP of the server but I get an error when I make that change.

            alt text

            1 Reply Last reply Reply Quote 0
            • C
              conor
              last edited by May 1, 2019, 12:15 PM

              There is no ports option as you have Protocol set to Any, that needs to be set to TCP/UDP or one of them to see ports. For example ESP, ICMP and AH protocols do not have ports.

              200+ pfSense installs - best firewall ever.

              H 1 Reply Last reply May 1, 2019, 12:18 PM Reply Quote 1
              • H
                HansSolo @johnpoz
                last edited by May 1, 2019, 12:15 PM

                @johnpoz said in New User to pfSense - some doubts:

                @HansSolo said in New User to pfSense - some doubts:

                So are you also agreeing that pfSenseBlockerNG has incorrectly configured their settings?

                NO!!! I just ran through the wizard and it didn't create single rule on my WAN!!

                Really ????
                I didn't create those rules. Honest.
                I wonder if it's because our configurations are different? Are you running a server behind your pfSense?
                What version pfsense are you running?

                J 1 Reply Last reply May 1, 2019, 12:21 PM Reply Quote 0
                • H
                  HansSolo @conor
                  last edited by HansSolo May 1, 2019, 12:18 PM May 1, 2019, 12:18 PM

                  @conor said in New User to pfSense - some doubts:

                  There is no ports option as you have Protocol set to Any, that needs to be set to TCP/UDP or one of them to see ports. For example ESP, ICMP and AH protocols do not have ports.

                  Ah!
                  ok.

                  It's a mystery then why those rules were created like that?

                  I DID NOT create those rules and thought they were just part of the pfSenseBlockerNG setup.

                  Good thing my server is still behind my WG Firebox at the moment and not the pfSense firewall.

                  1 Reply Last reply Reply Quote 0
                  • J
                    johnpoz LAYER 8 Global Moderator @HansSolo
                    last edited by johnpoz May 1, 2019, 12:23 PM May 1, 2019, 12:21 PM

                    @HansSolo said in New User to pfSense - some doubts:

                    I wonder if it's because our configurations are different? Are you running a server behind your pfSense?
                    What version pfsense are you running?

                    Yes I have ports forwarded, I run ntp server to the world via ntp pool.. I have friends and family access to my plex server.

                    As to what version of pfsense I run - its in my signature.. And yes I would be running current, as any sane person should be.

                    That you think an any any rule is ok on your wan - even IF some tool created it.. Is just beyond nuts...

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                    1 Reply Last reply Reply Quote 0
                    • S
                      stephenw10 Netgate Administrator
                      last edited by May 1, 2019, 12:23 PM

                      They are created by pfBlocker but only because of how it's configured.

                      pfBlocker can create firewall rules but does not have to. It depends what you have set the list action to.

                      Typically it is set to add block rules to prevent LAN side clients reaching out to, for example, known malware sites.

                      However I recommend setting the list action to Native Alias only and then using those aliases in rules you add yourself.

                      Also worth noting the pfBlocker setup wizard is only in the dev version I believe.

                      Steve

                      1 Reply Last reply Reply Quote 0
                      • J
                        johnpoz LAYER 8 Global Moderator
                        last edited by johnpoz May 1, 2019, 12:26 PM May 1, 2019, 12:25 PM

                        While the wizard might be only in dev... The older version doesn't create rules like that without being told to do it..

                        You don't install any version of pfblocker and next thing without doing anything have any any rules on your wan... That would be insane!!

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                        H 1 Reply Last reply May 1, 2019, 12:42 PM Reply Quote 0
                        • H
                          HansSolo @johnpoz
                          last edited by May 1, 2019, 12:42 PM

                          @johnpoz said in New User to pfSense - some doubts:

                          While the wizard might be only in dev... The older version doesn't create rules like that without being told to do it..

                          You don't install any version of pfblocker and next thing without doing anything have any any rules on your wan... That would be insane!!

                          ok ok...I'm probably not insane (or nuts). and no, I do not think ANY rule is "ok". Not sure where you assumed that. Just not familiar with pfsense and pfSenseBlockerNG. Day 3 with pfSense so I can't possibly know everything about how it and the blocker works under the hood. I thought it was some kind of fancy proxying of the lists and DNS manipulation.

                          I did check with my cell phone and no access was granted to any unauthorized part of the network so no harm done.

                          1 Reply Last reply Reply Quote 0
                          • J
                            johnpoz LAYER 8 Global Moderator
                            last edited by May 1, 2019, 12:43 PM

                            @HansSolo said in New User to pfSense - some doubts:

                            I do not think ANY rule is "ok". Not sure where you assumed that

                            Because you had them on your wan ;) And then asked if they were ok...

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                            H 1 Reply Last reply May 1, 2019, 12:44 PM Reply Quote 0
                            • H
                              HansSolo @johnpoz
                              last edited by HansSolo May 1, 2019, 12:47 PM May 1, 2019, 12:44 PM

                              @johnpoz said in New User to pfSense - some doubts:

                              @HansSolo said in New User to pfSense - some doubts:

                              I do not think ANY rule is "ok". Not sure where you assumed that

                              Because you had them on your wan ;) And then asked if they were ok...

                              Well think about it.....
                              If I was "insane" or "nuts", I probably wouldn't have even asked. ✌

                              Let's not beat up the noobs just because they are not totally familiar with pfsense yet and don't know right off the bat if automated configurations that they didn't put there are legit or not (even if they look odd)

                              Thanks for all the great advice everyone ! 😎

                              1 Reply Last reply Reply Quote 0
                              • J
                                johnpoz LAYER 8 Global Moderator
                                last edited by May 1, 2019, 12:48 PM

                                Where exactly are you seeing that rule that doesn't allow you dest port in it.. What version of pfblocker are you running the older or dev version?

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                H 1 Reply Last reply May 1, 2019, 12:49 PM Reply Quote 0
                                • H
                                  HansSolo @johnpoz
                                  last edited by HansSolo May 1, 2019, 12:51 PM May 1, 2019, 12:49 PM

                                  @johnpoz said in New User to pfSense - some doubts:

                                  Where exactly are you seeing that rule that doesn't allow you dest port in it.. What version of pfblocker are you running the older or dev version?

                                  by the time I reply, you will probably have discovered that that was answered above ☺

                                  as for the pfBlocker version.....3 days in, so I downloaded it probably yesterday. latest, I assume ?

                                  Let me check and see if I can find that version.....

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by johnpoz May 1, 2019, 12:55 PM May 1, 2019, 12:50 PM

                                    @HansSolo said in New User to pfSense - some doubts:

                                    pfSenseBlockerNG

                                    what version does it say.. that tells me not the old one... But maybe you have not updated your packages? Can not tell if you mean non dev or dev version.

                                    its listed right in your package manager
                                    example
                                    pfBlockerNG-devel 2.2.5_22

                                    there should be really screaming red flags on the pfblocker gui that its going to create an any any rule.. If that is what its doing.

                                    Where exactly did you go in pfblocker to create said rule.

                                    Paging @BBcan177 if pfblocker creates any any rules on the wan without huge warnings to the user.. That really should be changed..

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                    H 1 Reply Last reply May 1, 2019, 1:04 PM Reply Quote 0
                                    • H
                                      HansSolo @johnpoz
                                      last edited by HansSolo May 1, 2019, 1:05 PM May 1, 2019, 1:04 PM

                                      @johnpoz said in New User to pfSense - some doubts:

                                      @HansSolo said in New User to pfSense - some doubts:

                                      pfSenseBlockerNG

                                      what version does it say.. that tells me not the old one... But maybe you have not updated your packages? Can not tell if you mean non dev or dev version.

                                      its listed right in your package manager
                                      example
                                      pfBlockerNG-devel 2.2.5_22

                                      there should be really screaming red flags on the pfblocker gui that its going to create an any any rule.. If that is what its doing.

                                      Where exactly did you go in pfblocker to create said rule.

                                      Paging @BBcan177 if pfblocker creates any any rules on the wan without huge warnings to the user.. That really should be changed..

                                      pfBlockerNG net 2.1.4_16

                                      Agreed. Unless......that rule doesn't actually give said access.
                                      Let's hope the developer will reply regardless of the outcome.

                                      I KNOW I didn't create those rules intentionally.....but maybe they got created some how that I'm not aware of other than by pfBlockerNG ?

                                      My gut feeling is that they were created intentionally and do not allow the access it appears.
                                      That said...I've changed them all as suggested.....to be safe. (And I have not yet reconnected pfsense, still using WG)

                                      And as mentioned, I DID CHECK WITH MY CELL PHONE and was not able to find any compromised connections.

                                      1 Reply Last reply Reply Quote 0
                                      • J
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by May 1, 2019, 1:04 PM

                                        @HansSolo said in New User to pfSense - some doubts:

                                        Agreed. Unless......that rule doesn't actually give said access.

                                        It DOES!! since its a rule on your WAN...

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                        H 1 Reply Last reply May 1, 2019, 1:06 PM Reply Quote 0
                                        • H
                                          HansSolo @johnpoz
                                          last edited by HansSolo May 1, 2019, 1:12 PM May 1, 2019, 1:06 PM

                                          @johnpoz said in New User to pfSense - some doubts:

                                          @HansSolo said in New User to pfSense - some doubts:

                                          Agreed. Unless......that rule doesn't actually give said access.

                                          It DOES!! since its a rule on your WAN...

                                          But in the source it lists a pfBlockerNG file, NOT a network location. What do you interpret that to mean?

                                          OTOH...I can't speak for anyone else, but there's so much information to absorb in such a short time, brain farts do occur.
                                          And it's possible I experienced a real winner.

                                          1 Reply Last reply Reply Quote 0
                                          28 out of 96
                                          • First post
                                            28/96
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.