Please check my firewall rules (newbie)
-
Just configured a new SG-1100. On the LAN side, I left the default rules in place:
For OPT, I duplicated the pass-all rule:
I want to be sure that no traffic can pass from the LAN to OPT, or vice-versa (segregating my work PC on OPT). LAN has 192.168.1.1/24 as its address and OPT has 192.168.2.1/24. I assume that will prevent anything crossing interfaces, but want to be sure.
And, of course, I want to be very sure that all unsolicited inbound traffic from the WAN is blocked.
Thanks for looking!
-
@nguser6947
Since the default LAN rule allows access to anywhere, it allows access to OPT net as well, of course.If you want to block traffic to the other network add a block rule to the top of the rule set with the respective other network in the destination section.
Or if you generally want to block traffic between local subnets and to be safe albeit future changes, you can add an alias of type IP and add all RFC1918 networks to it and use this as destination in a block rule. However, doing this way, you may have to add an additional pass rule to allow DNS access to pfSense if you use the firewall as your DNS server. -
Blocking bogon is pointless on a local network.
Even more so when you list your source as only Lan Net or Opt.. Which limits traffic with those source IPs.. How would would bogon ever be allowed? So its a pointless rule to put on your lan side networks.
Lan net would be allowed per your rules - anything else would be blocked by the default deny.. ie any bogons ;)
-
Thank you both.
I updated the rules as such:
Same rule added (in reverse) for the LAN. -
@johnpoz said in Please check my firewall rules (newbie):
Blocking bogon is pointless on a local network.
Even more so when you list your source as only Lan Net or Opt.. Which limits traffic with those source IPs.. How would would bogon ever be allowed? So its a pointless rule to put on your lan side networks.
Lan net would be allowed per your rules - anything else would be blocked by the default deny.. ie any bogons ;)
I am getting a few of these in the Firewall log:
Is this the one (work) PC on OPT trying to hit things on my LAN network, or some sort of noise that can be ignored? Thank you. -
Yeah - and you shouldn't be blocking it.. Its dhcp.. Blocking bogon locally is going to cause you nothing be issues.
Turn it OFF!!
I just went over why its is completely pointless to block bogon on your own local network.. And you just posted how it can break stuff!
Why are you seeing OPT on LAN?? Why is the rule say OPT on it, but the interface is LAN?
-
@johnpoz said in Please check my firewall rules (newbie):
Yeah - and you shouldn't be blocking it.. Its dhcp.. Blocking bogon locally is going to cause you nothing be issues.
Turn it OFF!!
I just went over why its is completely pointless to block bogon on your own local network.. And you just posted how it can break stuff!
Why are you seeing OPT on LAN?? Why is the rule say OPT on it, but the interface is LAN?
John, please bear with me, as I stated I'm a newbie at this. I think I see where I messed up. In "reserved networks" in the interface definitions, I had checked the "block bogon" checkbox. I've since cleared them.
Again, thank you.
-
But now you have me curious why the firewal log say for OPT was triggered on the LAN interface? That makes no sense at all..
