Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Firewall directions

    Scheduled Pinned Locked Moved Firewalling
    26 Posts 3 Posters 2.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • kiokomanK
      kiokoman LAYER 8
      last edited by

      did you configure the openvpn on pfsense or under some pc/server you have on your lan ?

      ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
      Please do not use chat/PM to ask for help
      we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
      Don't forget to Upvote with the 👍 button for any post you find to be helpful.

      1 Reply Last reply Reply Quote 0
      • T
        techtester-m
        last edited by techtester-m

        I configured an OpenVPN client on pfSense. In this case NordVPN.

        I think I'll just create the rules I want and post a screenshot here. Then we'll proceed.

        Thanks man,

        1 Reply Last reply Reply Quote 0
        • kiokomanK
          kiokoman LAYER 8
          last edited by kiokoman

          then a client is not a server
          as we said before you are able to enter that interface because the default rule for LAN interface is to allow all
          the OpenVPN tab for you is like another WAN
          openvpn is another monster that have different implementation

          ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
          Please do not use chat/PM to ask for help
          we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
          Don't forget to Upvote with the 👍 button for any post you find to be helpful.

          1 Reply Last reply Reply Quote 0
          • T
            techtester-m
            last edited by

            Yeah...My bad. When I wrote VPN "Servers" I meant my OpenVPN clients, which in turn connect to an actual VPN server haha.

            @kiokoman said in Firewall directions:

            you are able to enter that interface because the default rule for LAN interface is to allow all

            And what about allowing all the VLANs to use the OpenVPN client as well? Their RFC1918/IPv4* blocking rule won't affect it? The local virtual addressed of these VPNs are 10.x.x.x which fall under RFC1918......I thought I understand pfSense and firewall and everything is actually working, but the deeper I dig I get a headache LOL...

            1 Reply Last reply Reply Quote 0
            • kiokomanK
              kiokoman LAYER 8
              last edited by

              of course, if you want another interface to be able to use the vpn interface you need to create a rule that permit that.
              RFC1918/IPv4* blocking rule inside an interface like OPT1/OPT2 etc will prevent it but you just need a previus rule like
              "permit OPT1 net destinatio OpenVPN" before "block OPT1 net destination RFC1918". first rule win !

              ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
              Please do not use chat/PM to ask for help
              we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
              Don't forget to Upvote with the 👍 button for any post you find to be helpful.

              T 1 Reply Last reply Reply Quote 1
              • T
                techtester-m @kiokoman
                last edited by

                @kiokoman That's what I thought. Thanks a bunch!

                1 Reply Last reply Reply Quote 0
                • T
                  techtester-m @JeGr
                  last edited by

                  @JeGr said in Firewall directions:

                  allow DNS/NTP from opt1_net

                  It's either or? Or should I allow both of them UDP/53, UDP/123?

                  1 Reply Last reply Reply Quote 0
                  • kiokomanK
                    kiokoman LAYER 8
                    last edited by kiokoman

                    i think it was just an example,
                    port 53 is for DNS (domain name system) pretty much mandatory if you want to resolv dns and surf the web
                    port 123 is for NTP (Network time protocol) useful but not mandatory, it's needed to sync the clock
                    that said the minimum port to be able to surf the web are udp/tcp 53 for dns tcp 80 for http and tcp 443 for https

                    ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
                    Please do not use chat/PM to ask for help
                    we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
                    Don't forget to Upvote with the 👍 button for any post you find to be helpful.

                    T 1 Reply Last reply Reply Quote 1
                    • T
                      techtester-m @kiokoman
                      last edited by

                      Screen Shot 2019-11-26 at 18.48.53.png

                      What about the VPN Group shown in the screenshot? I think that adding "Allow PCS_VLAN to OpenVPN(1194)" won't be enough, since the VPN clients' gateways are in the range of RFC1918 - 10.x.x.x.

                      What rule(s) exactly should I add in order for this VLAN to be: isolated from other interfaces, have internet access and connect to the internet via the VPN_Group (NO_WAN_EGRESS)?

                      1 Reply Last reply Reply Quote 0
                      • kiokomanK
                        kiokoman LAYER 8
                        last edited by

                        that rule probably won't work,
                        you just need to put it before the block

                        ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
                        Please do not use chat/PM to ask for help
                        we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
                        Don't forget to Upvote with the 👍 button for any post you find to be helpful.

                        T 1 Reply Last reply Reply Quote 0
                        • T
                          techtester-m @kiokoman
                          last edited by

                          @kiokoman said in Firewall directions:

                          you just need to put it before the block

                          Put what rule? I'm already confused here man...you'd have to be more specific. Sorry :)

                          1 Reply Last reply Reply Quote 0
                          • kiokomanK
                            kiokoman LAYER 8
                            last edited by kiokoman

                            bs

                            ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
                            Please do not use chat/PM to ask for help
                            we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
                            Don't forget to Upvote with the 👍 button for any post you find to be helpful.

                            T 1 Reply Last reply Reply Quote 0
                            • T
                              techtester-m @kiokoman
                              last edited by techtester-m

                              @kiokoman I thought that's what you meant but wouldn't that make the blocking rule useless, since we allow everything else here? See @JeGr answer above. Or perhaps that's not the case because it's setup to use the VPN gateway instead of the default one?

                              The more I ask, the more I get confused which has never happened to me before in my life LOL...gotta read the pfSense book a little, when having the chance haha...

                              1 Reply Last reply Reply Quote 0
                              • kiokomanK
                                kiokoman LAYER 8
                                last edited by kiokoman

                                after 9 hours of work you should understand that my brain is telling me bs now 😑
                                you are right i make a mistake, i was not seeing the tab and i was confused

                                but you probably need a new rule that permit traffic from PCS_VLAN net with destinaton OpenVPN net before the block
                                but right now, i confess i'm tired, maybe try and tell us if it work or not

                                ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
                                Please do not use chat/PM to ask for help
                                we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
                                Don't forget to Upvote with the 👍 button for any post you find to be helpful.

                                T 1 Reply Last reply Reply Quote 1
                                • T
                                  techtester-m @kiokoman
                                  last edited by

                                  This post is deleted!
                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.