Floating rule matched but firewall doesn't respond

clarknova

@johnpoz said in Floating rule matched but firewall doesn't respond:

So your not doing nat? If so you would need your port forwards before any firewall rules would work.

No NAT, just trying to reach the web UI on its public address.

clarknova

@jimp said in Floating rule matched but firewall doesn't respond:

If the rules look identical then the problem isn't in the rule. It's somewhere else in your ruleset. The rules are processed in a different order depending on where they are in the ruleset.

Interesting. If I don't block RFC1918 addresses on the WAN then I can reach the web UI. But my source address is not rfc1918, and I can verify this by both the source address in the pass rule, with tcpdump, and with the firewall logs.

What would case the rfc1918 rule to block a valid publicly-routable address?

clarknova

However I am using a socks proxy. Could this be a factor? pfSense sees the connection from the public IP address of my ssh server, so I don't see how it could be unless there is some filtering happening above the IP layer.

jimp

Are you sure it's public?

The reply-to entry on your rule is 192.0.2.1 and that is not a publicly routable subnet.

johnpoz

yeah 192.0.2 is used for documentation - are you obfuscating it?

clarknova

@jimp said in Floating rule matched but firewall doesn't respond:

Are you sure it's public?

The reply-to entry on your rule is 192.0.2.1 and that is not a publicly routable subnet.

I substituted that for the real address. I've attached the unedited output of the firewall log. PUB03 is the WAN. The Source and Destination addresses in the log match the public IP addresses of my socks proxy and pfSense WAN, respectively.

johnpoz

I can ping that IP..

clarknova

@johnpoz said in Floating rule matched but firewall doesn't respond:

I can ping that IP..

That's expected. I can ping it too, but only if I'm not blocking rfc1918.

johnpoz

Well that would make zero sense ;)

If for whatever reason rfc1918 rule was blocking it, ping should be included in that block.

clarknova

I think I have this solved, partly. One of the disconnected interfaces on pfSense is in the same subnet as 104.37.148.83, so that's maybe going to cause a problem, although I don't see replies going out that interface, maybe because it's disconnected.

The other mystery is why disabling the rfc1918 filter causes the wan to be reachable from that subnet.