[SOLVED] router accepts ICMP ping even after rule
-
It was my understanding that by default, pfSense is suppose to block ICMP Echo (ping) but I realized it does not.
I made a rule especially for it but it still respond to ping from WAN ?
Where to look ?
-
If you're changing rules ensure there isn't an active state that would continue to allow the connection. (Diagnostics/States)
-
@ninthwave , there is some misunderstanding in pfsense community, Some of users still think, if there is no rule, it is automatically blocked. But as you already noticed pfsense accepts icmp.
I see you already made a interface rule. If you want to block whole icmp, make also a floating rule to block icmp and make sure check the log option box.
-
Stop spreading fud please
-
@akegec said in [SOLVED] router accepts ICMP ping even after rule:
But as you already noticed pfsense accepts icmp.
No it doesn't - the wan rules out of the block do not allow anything.. Ping does not work to the wan from the wan side out of the box..
I am with @heper here - stop spreading FUD..
The most likely explanation to the OP issue was a state that was allowing from a rule change.. Or he was saying pinging is wan IP from the lan side.. Which defaults to an any any rule.
Please show me where in the rules, where icmp is allowed out of the box to the wan from wan side.. You can easy look at the full rule set
https://docs.netgate.com/pfsense/en/latest/firewall/pf-ruleset.html
While there are some hidden rules sure - to keep the user from shooting themselves in the foot.. Like the rules that allow for dhcp when you enable dhcp server on an interface.. The rule that allows pfsense itself outbound, etc..
But there is no rule that allows you to ping pfsense wan from the wan side or internet out of the box.. There is no need for the rule the OP shows to block ping on the wan..
-
@akegec said in [SOLVED] router accepts ICMP ping even after rule:
if there is no rule, it is automatically blocked
More specifically:
https://docs.netgate.com/pfsense/en/latest/firewall/best-practices.html
"In a default two-interface LAN and WAN configuration, pfSense utilizes default deny on the WAN and default allow on the LAN. Everything inbound from the Internet is denied, and everything out to the Internet from the LAN is permitted." -
What I was trying to say if they didn't see it doesn't mean it is not there. I had a discussion with my Belgian client, his network has been compromised including his pfsense, but he is so stubborn and keeps telling me that there is no logs.
-
I had the same doubt, but i routed from cellphone in my notebook and do not ping. I had disabled the rule, and i noticed with or without the rule... there is no ping from external ips. I don't know why and how to explain ping blocked without a rule setted on WAN.
-
@marcus-vinicius said in [SOLVED] router accepts ICMP ping even after rule:
I don't know why and how to explain ping blocked without a rule setted on WAN.
because the default is deny.. If you have no rule on wan that allows icmp - then no it won't answer ping.
-
Yes, that is the expected behaviour:
https://docs.netgate.com/pfsense/en/latest/firewall/rule-methodology.html#default-deny-ruleIf you're seeing anything different it's probably either because the ping traffic is not passing the interface you think it is or there are rules on other tabs passing it you have not considered (floating rules, interface groups).
Steve
