FW-rules related to an specific "IPV6-device"
-
@louis2 said in FW-rules related to an specific "IPV6-device":
however in case some mallware did arrive on one of my servers
Right. A server should be in a DMZ and it should always only be allowed to approved destinations.
Exactly the type of network segmentation I was talking about.
No matter what you do on the firewall, if all of your hosts are on one segment there is nothing you can do in the firewall to stop them from infecting other nodes on that segment.
-
Derelict,
That brings me to another item.
Suppose you are working in the Netgate development office having sensitive information. And of course there are other Netgate offices in the same building.
Now you have to protect your data and there are two options:
- you lock the door of your department or
- you go to the other offices and tell them that they should not enter your door (and you trust them)
Which option would you choose .... I assume the first one, every office should is responsible for its own front door.
However, ...... pfSense does not offer that concept ..... it only offers method 2
Suppose your office is having subnet/interface-A
And another office is having subnet/interface-BThen the rules related to Interface-B can block access to your front door using outgoing rules ...
However you can not protect your own front door since there is no incoming filtering.This is not 100% true, because there is something like floating rules, but .... nevertheless ..... I do not like the concept!
Louis
-
I do not understand your analogy.
A firewall has nothing to do with what passes between members of the same network segment.
If you do not like how pfSense (pf) processes traffic, yes, you can use floating rules in the outbound direction.
If that is insufficient, then pfSense is probably not the solution for you because that is how pf works. A common firewall best practice is to block the traffic as it enters the firewall, not as it exits. This is a firewall, not an office building.
You could also do something like a default deny for an inside IP address or network with a floating rule on all interfaces in any direction to a specific inside destination with quick not set. You could subsequently pass any desired traffic to that destination from certain zones. All other traffic to that destination will be denied.
But that will only work if the traffic passes through the firewall in the first place, which will not happen if the traffic is coming from something on the same network segment.
-
Derelict,
I had exactly the same firewall rules in mind you describe! It is not perfect, but it is helps!
something like:
- normal rules per interface, describing what is allowed inside
floating rules
- block IPV4 traffic towards 192.168.0.0/16
- allow IPV4 (the rest)
- block IPV6-myrange
- allow IPV6 (the rest)
Related to the last sentence, the traffic is never comming from the same network segment, since I devided the network in segments like "PC-LAN", "GUEST-LAN", IoT-LAN, RedZone, GreenZone, Mngt.
Each segment is an vlan with its own interface. In case that servers on the same vlan / segment are not allowed to reach each other, you could use level2 private VLAN's. I only do that for my WIFI.
Louis
-
@louis2 said in FW-rules related to an specific "IPV6-device":
block IPV4 traffic towards 192.168.0.0/16
If you have a firewall that prevents access from B from going to A, there is really no point in creating a rule in the outbound direction on interface A (into A).. It will never be triggered.. And just causing you more work for no benefit..
-
John, Derelict,
Yep If you do it the way you desctibe yes, you are right, however ....
As described above,
- at the gateway of "other" VLAN's you should define rules, related to what is allowed to leave the vlan
- at the gateway of the VLAN "to protect" you should describe what is allowed to enter the VLAN
That is more secure and .... it even cost less rules, because if you have to add a rule at the GW of each other VLAN that it is not allowed to go to the protected VLAN:
- it will cost you n-rules
- you can forget to add a rule at one of the vlans
- and perhaps each vlan is managed by/under responsibility its own department manager, which does not match
So what I did is the following
Assume we have only three VLAN's
- PCLAN which should be capable to access the NAS in the GreenZone
- We have the GreenZone which should only be accessable from the PCLAN
- We have the Redzone which should under no circumstances be allowed to reach the NAS / GreenZone
So now what I did
-
PCLAN
Rule-1: PASS destination GreenZone -
Floating Rules
Rule-1: BLOCK, Interface "GreenZone", Direction out, Address IPV4+IPV6, TCP+UDP
Rule-2: PASS, QUICK, Interface "GreenZone", Direction out, Address IPV4+IPV6 ,TCP+UDP, Source PCLAN -
RedZone (or any other (V)LAN
Nothing OR
Rule-1: Pass Destination GreenZone OR
Rule-1: BLOCK Destination GreenZone OR
So with the rules given under PCLAN I give permission to go to the NAS
With Floating Rule-1, I block traffic out of any (V)LAN,
With Floating Rule-2 I make an exception for the PCLANThe rules related to any other interface e.g. Redzone do not matter. What ever is there, systems in that vlan will never have access to my NAS
That is how I do it at the moment. The only point is, that the Floating rules having an InterFace set, should be at the interface tab and not on the Floating tab. (and it would be handy if the rule direction would be presented in the GUI.
Can you support me?
Louis
-
Inline with my owh perception ant the more after this thread and also the thread you where refering to (How to create IPv6 firewall rules?), I am more that ever convinced that it is simply impossible to create device specific IPV6-rules based on IP-address.
So IMHO no other option than mac-filtering (I know not supported in pfSense).
Louis
-
In line with my original perception and the more after reading the responses in this thread
and also reading the thread “How to create IPv6 firewall rules?”,I am more than ever convinced that it is simply impossible to create device specific IPV6-rules based on IPV6-address.
The only option I see is using the device its mac-address. Its level-2 I know.
I also know mac and IP van both be spoofed, but never the less, having the option to “allow” or “block” a specific device is very wroth full having.
Also note that it is not a good idea to force a specific IPV6 address in a / all specific computers, if even possible(!). And apart form that the changing addresses are helping privacy a bit.
So my conclusion can not be different than that we have to push in the direction of mac based rules!!
Louis
-
In line with my original perception and the more after reading the responses in this thread
and also reading the thread “How to create IPv6 firewall rules?”,I am more than ever convinced that it is simply impossible to create device specific IPV6-rules based on IPV6-address.
The only option I see is using the device its mac-address. Its level-2 I know.
I also know mac and IP van both be spoofed, but never the less, having the option to “allow” or “block” a specific device is very wroth full having.
Also note that it is not a good idea to force a specific IPV6 address in a / all specific computers, if even possible(!). And apart form that the changing addresses are helping privacy a bit.
So my conclusion can not be different than that we have to push in the direction of mac based rules!!
Louis
PS this is a copy of my post to @Derelict (since you are two most relevant people around here
) -
Note that I found another discussion on this subject a couple of years ago
https://forum.netgate.com/topic/103460/firewalling-mac-addresses
Whatever! given IPV6 with its "changing IPs" we simply need! mac-filtering to be able to filter traffic from or towards a specific devices in our own subnet.
- to allow something for that device (originating or destinating)
- or to block something
Just the same things you can do with an IPV4-adress
Louis
