Interface subnet misconfigured /32 and firewall default allow rule

[bogdanm]

I misconfigured (probably for some time) LAN interface to be 192.168.1.1/32 instead of 192.168.1.1/24.
The "Default allow LAN to any rule" is on interface "LAN" allow "LAN net" to "any" ("LAN net" I presume is 192.168.1.1/32)
Can you tell me why traffic is passed from all subnet 192.168.1.1/24 to WAN? (internet is working properly for computers in 192.168.1.1/24)
If I set network 192.168.1.1/32 instead of "LAN net" traffic will be dropped (cannot acces internet from computers in subnet 192.168.1.1/24)
I think PFSense is finding that /32 is invalid from LAN and use another submask (but in DHCP server LAN interface will not appear for selection - I don't use DHCP server for this LAN) .

Thanks.

[johnpoz]

lets see your rules.. Also look at your full rules.

pfctl -sr

You would see what your lan net is set to.. So for example
pass in quick on igb0 inet from 192.168.9.0/24 to any flags S/SA keep state label "USER_RULE: Default allow LAN to any rule"

Do you have anything on floating?

Maybe your devices using IPv6 to get out? Are you running transparent proxy? Or explicit proxy?

BTW

for computers in 192.168.1.1/24

Is not a network, that is a host address.. 192.168.1.0/24 would be the network.

I just changed my test network to /32 for the interface, and did a force reload of the rules to make sure.. And now if I look at the rules, it only allows its address with no mask

pass in quick on igb4 inet from 192.168.200.1 to any flags S/SA keep state label "USER_RULE: Allow Internet"

[bogdanm]

@johnpoz
In Interfaces->LAN (em1) is configured: Static IPv4 Configuration 192.168.10.2 / 32 (I replaced with a generic ip 192.168.1.1/32 in my post).
with pfctl -sr:
pass in quick on em1 inet from 192.168.10.2 to any flags S/SA keep state label "USER_RULE: Default allow LAN to any rule"
pass in quick on em1 inet from 192.168.10.0/24 to any flags S/SA keep state label "USER_RULE: Default allow LAN to any rule"

if I put In Interfaces->LAN (em1) Static IPv4 Configuration 192.168.10.2 / 24:
with pfctl -sr
pass in quick on em1 inet from 192.168.10.0/24 to any flags S/SA keep state label "USER_RULE: Default allow LAN to any rule"

No ipV6, VLAN or floating rules, but the firewall configuration is older (more than 2 years) and somewhat complicated (2 WAN, Openvpn, multiple port forwards). I will try same thing on a new installation.

Thanks.

[JKnott]

@bogdanm said in Interface subnet misconfigured /32 and firewall default allow rule:

Can you tell me why traffic is passed from all subnet 192.168.1.1/24 to WAN?

When a device sends a packet, it compares the network portion of the address with that of the local network. It does this by using the subnet mask, to isolate the network portion of the address. With a /32 subnet mask, there can only be one device on the local network and so any other address within 192.168.1.0 /24 must be elsewhere and traffic for it is sent out to the gateway.

[johnpoz]

@bogdanm said in Interface subnet misconfigured /32 and firewall default allow rule:

pass in quick on em1 inet from 192.168.10.0/24 to any flags S/SA keep state label "USER_RULE: Default allow LAN to any rule"

Well that rule would allow it... So you have 2 rules there one that is with the /32 the .10.2 and then another with 10.0/24 the network that would allow anything in that network. So you didn't reload your rules after you changed it?

But that rule you show would for sure allow the traffic - so that explains why its allowed even though you have a /32 on your interface. And thinking lan net should only be itself.. Which is the rule above... Why you have 2 rules I don't know.. You prob didn't do a reload.

[Derelict]

@johnpoz said in Interface subnet misconfigured /32 and firewall default allow rule:

Why you have 2 rules I don't know.

My guess would be it was duplicated by user action and the netmask corrected.

Show us Firewall > Rules, LAN, Firewall > Virtual IPs

[bogdanm]

Yes, is from Virtual IP - 192.168.10.7/24 is an IP alias - the pfsense router has replaced two single wan routers - 192.168.10.2/24 and 192.168.10.7/24 some years ago.

I tested on an pfsense VM and replicated the double allow rule.
Thanks for help, good to know that pfsense is reliable and is a user error.