PfBlockerNG GEOIP for open ports.
-
@lrossi search the internet for a non us port scanner.
-
Not sure why you think this is so complicated. If you only want to allow countries xyz into your port forward.
Then only allow that alias you created in pfblocker, as source in your port forward..
There is nothing more too it.
There is no need for ! rules blocking above..
-
@johnpoz , your suggestion is more straight forward simple and elegant but when i try to implement it I just cannot access my services. This is how my rules looked when i tried:
I don't understand why that didn't work.
But then the advisement from @NogBadTheBad made me think that maybe my problem is that services were not accessible from within my network but they are from outside.
So i went to https://www.whatsmyip.org/port-scanner/ to do a port scan and it confirmed that my ports were indeed accessible from outside my network.
So, this is the situation, when i put the list of allowed countries as the source for my NAT rules, i cannot access my services from within the network. When i set that source to "any" and i create a block rule as described in my previous post, then my services are accessible from inside and outside the network.
Ideas? suggestions? on how to use my list of allowed countries as the source for my NAT rules AND have those ports available to clients within the LAN?
-
@lrossi said in PfBlockerNG GEOIP for open ports.:
i cannot access my services from within the network
Well that really has nothing to do with what is allowed or not allowed really - you can have that issue with wide open rules. You either need to setup nat reflection or setup just local dns resolution to your services.
Your plex server for example should always just hit its local IP..
-
@johnpoz, your comment made me check what i had set for NAT reflection in my NAT rules. They were set to “Use system defaults”.
The system defaults in System--> Advanced --> Firewall & NAT--> NAT Reflection mode for port forwards, was already set to “Pure NAT”.
OK, this should work now. I went back to my NAT rules and set them to use my “GEOIP_Allow” countries list as their source. Clicked save and apply changes and, just like before, my services were available to the world but not from within the LAN.
So, i went to the PFSense documentation to learn more about NAT reflection and, in there, i saw that they recommend to use a split DNS entry instead of NAT reflection. I followed their instructions and set up a Host override pointing my DDNS URL to the local LAN IP of the machine serving the services on the forwarded ports.
Like magic, everything worked.
Thank you so much to you and @NogBadTheBad for helping me identify that my GEOIP blocking problem was actually a DNS problem.
Now my firewall rules looks very simple and are easy to understand.
-
I sure wouldn't allow 80 to pfsense wan.. Did you disable pfsense redirection of 80 to your https port?
Better option for acme is prob dns vs http check.
-
@johnpoz, yes i disabled the redirection of port 80 and set my TCP port to 10443 in order to get my webconfigurator out of ports 80 and 443.
Please note that this particular rule is not pointing to the WAN address, it is pointing to "this firewall". Since the webconfigurator is not available at port 80 and i have no services available at this port either, the incoming traffic has nowhere to go.
I did this because I tried to use ACME with the DNS method but i couldn't find a way to make it work with my DDNS provider (duckdns).
-
@lrossi said in PfBlockerNG GEOIP for open ports.:
it is pointing to "this firewall"
Which includes ALL ips setup on the firewall = your wan being one of them ;)
with my DDNS provider (duckdns).
huh? You would create the record in your authoritative ns.. I was not aware that duckdns allowed you create such records. Thought you just point a cname to whatever your duckdns fqdn is..
-
@johnpoz, I wasn't aware. Ignorance is bliss.
Regardless, do you think my network is still exposed when i have no services on port 80? -
If you have nothing running on 80, it shouldn't be a problem - but that alias is every IP on your firewall. For such a rule it would be bad practice to use such an alias.
Would you mind PM the domain your using for acme - curious to see who the SOA is for this domain.
