Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Need help with firewall rules

    Scheduled Pinned Locked Moved Firewalling
    22 Posts 4 Posters 1.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      macflo1508
      last edited by

      I'm lost....
      I created the rules as you suggested and it doesn't work. I attached the rules and the log. It looks to me like the log says it passed the traffic, but I get a time out. If I try to connect from a device in the 192.168.20.* range it works fine.WLAN Rules.png Log.png LAN Rules.png

      V 1 Reply Last reply Reply Quote 0
      • V
        viragomann @macflo1508
        last edited by

        @macflo1508
        Possibly the destination device blocks the access from other subnets.
        If there is a firewall running on the device and you didn't already add any rule to allow the access, this is usually the case.

        Also consider that your WLAN rules allowe access to any other subnet, since you have copied the default allow rule from LAN.

        johnpozJ 1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @viragomann
          last edited by johnpoz

          There is nothing in the log you posted for your 8088 port like you stated..

          And how you have the rule is completely pointless.. since right below that you have a rule that says any any..

          Whatever that is not working has nothing to do with your pfsense rules.

          As mentioned - look to your device on lan.. Firewall on it? Not using pfsense for gateway. Not listening on port you think its listening on... I don't see any logs to it on any port. But do see that your rule to port 8088 did get hit for a few KBs of traffic that 0/16 on the rule
          But the issue is not firewall rules on wlan that is for sure.

          All your blocks your showing there are broadcast traffic - so yeah blocked by default, pfsense would never do anything with said traffic anyway. Thee are ways to not have that logged even if you don't like seeing it.

          What are you rules on this DANTE interface? You don't allow network to even ping pfsense IP?

          sense.png

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

          M 1 Reply Last reply Reply Quote 0
          • M
            macflo1508 @johnpoz
            last edited by

            @johnpoz @johnpoz Still not working as it should. Since I'm really not a firewall expert, I very likely have some pointless stuff in there.
            The "Allow to any" is the default rule from pfsense to let traffic from OPT1 to OPT0.
            THe DANTE network doesn't need to do anything outside it's own network, especially no access to internet and it's clock is very delicate. Some people even leave out DHCP and just have fixed IP's and connect the devices to each other through a switch. But DHCP doesn't hurt according to Audinate, so I figured I will give them that. The Dante protocol is for multitrack audio transmission and works with same standards as VOIP.
            The receiving device on 192.168.20.5 is a Windows 10 computer, which I also tried to disable the firewall, but it still didn't work.
            Here's the updated rules for the DANTE network, which shouldn't have Internet access and no access to any other network:

            DANTE Rules.png

            Anybody have an idea on what to do? I'm willing to pay someone for his time if he can fix this via teamviewer.

            M 1 Reply Last reply Reply Quote 0
            • M
              macflo1508 @macflo1508
              last edited by

              Just to be complete, here are all the rules in pfsense. The IP changed to 192.168.40.102, so I changed the rule accordingly.
              WLAN Rules.png WAN Rules.png NDI Rules.png LAN Rules.png floating rules.png DANTE Rules.png

              johnpozJ M 2 Replies Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @macflo1508
                last edited by johnpoz

                Your 8088 rule has no point with those current rules.. Because you have an ANY ANY rule below it..

                It serves no purpose. The firewall rules are not your problem with whatever issue your having..

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                M 1 Reply Last reply Reply Quote 1
                • M
                  macflo1508 @macflo1508
                  last edited by

                  And here's the diagram on how it's wired:
                  vMix Schema.png

                  1 Reply Last reply Reply Quote 0
                  • M
                    macflo1508 @johnpoz
                    last edited by

                    @johnpoz I wouldn't know where else to look...
                    Thank's for your patience. You are being very helpful and I appreciate it.

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @macflo1508
                      last edited by johnpoz

                      Well for starters.. Either set that 8088 rule to log so you can actually see traffic that is allowed. Or log all you allowed traffic.

                      Sniff on pfsense, via the diagnostic menu, packet capture.. Look in your state table.

                      If you see traffic was sent on to this IP 8080.. And you get no answer, then figure out why. Does the device have a firewall, is it not even listening on 8088? Does it have a different gateway then pfsense, does it have a specific route sending the traffic from that source network to some other gateway?

                      Looks like to me you have 2 routers, so is where your trying to send traffic even using pfsense as its gateway.

                      Where is this WLAN on your drawing?

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                      M 1 Reply Last reply Reply Quote 0
                      • M
                        macflo1508 @johnpoz
                        last edited by

                        @johnpoz Thank's again. You pointed me in the right direction: The Windows machine running at 192.168.20.5 has Speedify installed on it, which resulted in the packages being routed to the wrong place. A NAT rule, saying that anything originating from 192.168.40.0/24 should go to LAN adress solved the issue.

                        NAT.png

                        Thank's again everybody for being so helpful with a Noob! Great forum!

                        johnpozJ 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @macflo1508
                          last edited by johnpoz

                          So you did a source nat from what you posted.

                          So to lan vs looking like it came from 192.168.40, your source natting it to look like it came from pfsense lan IP.

                          Not exactly clear on what your doing.. But if you have a vlan of 192.168.40, why would you not just want to route to it, vs natting between 2 rfc1918 networks?

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                          M 1 Reply Last reply Reply Quote 0
                          • M
                            macflo1508 @johnpoz
                            last edited by

                            @johnpoz That seems to have been the problem. Because of Speedify the receiver didn't know where the packet was sent from, so the packet was routed to WAN.
                            I don't have a vlan. The 3 networks (LAN, NDI, DANTE) go to the Mikrotik 24 port switch that has port isolation enabled for ports 1-8 (NDI), Ports 9-16 (LAN) and 17-24 (DANTE). This, according to several people that have a lot of experience with DANTE and NDI, is the best way to keep NDI from using the DANTE network.
                            If this is better practice than creating vlan's, I don't know, but it seems to work the way it should.

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @macflo1508
                              last edited by johnpoz

                              vlan is a interchangeable word with network, be it tagged or not - its a different network. Doesn't really matter if physical and not tagged or just a tagged vlan..

                              Port isolation - ie your switch virtually isolated layer 2, ie virtual lan ;)

                              So it doesn't matter if its a vlan or a native network.. Why the need to source nat makes no sense - why are you natting between 2 rfc1918 networks?

                              So where your sending this traffic has not gateway? That would be the only reason to have to source nat. Or its using a different gateway than pfsense the traffic coming from.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                              M 1 Reply Last reply Reply Quote 0
                              • M
                                macflo1508 @johnpoz
                                last edited by

                                @johnpoz My knowledge doesn't go far enough to explain why. I had a friend of mine, that is speciaised in setting up networks with Dante, NDI, etc and that's what he came up with. Since it seems to work fine; I will leave it like this. Although I would like to understand more about this subject, I will have to do some reading first, since my knowledge clearly doesn't go far enough for these types of setup.
                                Thank's again for the help!

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.