My Rules to block certain IPs from the internet is not working
-
The only thing I did in advanced as part of my troubleshooting was set state from Keep to None.
Should i revert that back to Keep?
-
@kom Thank you for those links, I will give them a read.
-
yeah your going to want to keep states ;)
The way your rule was written it would never triggered as you can see by the 0/0 - your destination was what you want your source to be if you want to block those 2 IPs from going to the internet.
-
-
BTW something is missing from this puzzle - because with the way those rules are. Nothing would be able to go to the internet.. Since you have no allow other than going to the gui of pfsense.
Do you have rules in floating or something?
-
@johnpoz Sorry for the confusion with my screen shots, there are plenty more rules below my screen shot, i just cut it off at the relevant line I had added for this purpose.
-
OK,
I disabled the WAN rule and flipped the LAN rule I had. and it now appears my laptop has no access to the internet.
It appears my laptop can still access other items on the LAN.
How do I set this up so that the IPs in this alias can't access the WAN or the LAN?
Thanks for all the help so far
-
@derekmarch ah - if you look close you can see the difference in color that would be the next row.. But yeah its always best to show all rules on an interface when troubleshooting..
It appears my laptop can still access other items on the LAN.
Well yeah.. pfsense has nothing to do with devices on the same network talking to each other.
If you don't want them accessing other stuff - move them to their own vlan would be the easy simple best solution.. Filtering devices on the same network from talking to each other would have to be done via your switch infrastructure, ie like a private vlan setup. Or via host firewalls. Pfsense has nothing to do with devices talking amongst themselves on a network - only to get off said network is where pfsense comes into play routing and firewalling.
-
@johnpoz I will be sure to keep that in mind next time I need help.
I guess i'll have to research what other options I might have if I want to block random devices from my LAN.
Thanks again, everyone, for all the help
-
See my edit to your question about devices on the same network.
Vlans are very handing for keeping device X from talking to Y - because you just put them in different vlans. Grouping like devices together that you want to talk to each other, etc and other devices that you don't want talking to other devices in their own vlan - but they would be able to talk amongst them selves on that vlan.
To keep devices on the same network from talking to each other - wired this is normally called a private vlan. In wireless its called client or ap isolation.
-
Hm, I do have a managed switch that I'll be configuring soon. I guess I'll setup a rule at that time to move this alias to its own VLAN.
Thanks
-
Yeah any smart switch should be able to do vlans - not all entry level smart switches would support stuff like private vlans though..
