Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    [SOLVED] why my WIFI-GUEST communicates with my LAN

    Firewalling
    2
    4
    796
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      azertypro last edited by

      Hello,

      My configuration :
      LAN - 192.168.1.0
      WIFI-GUEST 192.168.3.0

      My firewall configuration for the WIFI-GUEST

      I'm able to ping from my WIFI-GUEST network to my LAN network because the destination is ANY for ICMP

      I should add the first rule below to block all communication between my WIFI-GUEST and my LAN

      But i would like to delete this rule and configure properly my destination, any idea ?

      Regards,

      Kevin

      1 Reply Last reply Reply Quote 0
      • johnpoz
        johnpoz LAYER 8 Global Moderator last edited by

        so where do you want your guest to go on 53 (dns)  What is the dest you want them to go?  The whole internet?  What exactly uses 443 and 80 on UDP?

        If you want them to ping your lan, then put that rule above your block rule.  But your rules will work just fine.  Normally you would have source net on their of your wifi net.  And https is not done over udp, so allowing 443 on udp makes zero sense, etc.

        Why exactly are you wanting to limit your guests to only dns, http/https?  As long as they don't talk to your network why should you care where guests go and what ports/protocols they use?

        So for example this is my guest wifi rules.

        I allow them to ping the pfsense interface on that network.  Just so they can validate they can get to their gateway.  IPv6 really needs icmp to function correctly.  There might even be some hidden rules pfsense does for icmpv6 when enable ipv6 on it.  But that is there for my sanity that icmpv6 is open.

        I then reject any other traffic at all to ANY IP address on pfsense.  be it other networks or wan IP, etc.  I use reject on purpose because I have clients sometimes on that network and want to see the reject.  But you could just block if you wanted.

        I then have rules that say as long as your not going to my ipv4 or ipv6 networks - you can do whatever you want.  Keep in mind my guest via dhcp do not get handed pfsense for dns, they get handed public/isp dns.


        1 Reply Last reply Reply Quote 0
        • A
          azertypro last edited by

          Hello Johnpoz,

          Thank you for your help.

          It works !

          Regards,

          Kevin

          1 Reply Last reply Reply Quote 0
          • johnpoz
            johnpoz LAYER 8 Global Moderator last edited by

            So see you were picked up on the alias that I created for rfc1918, was going to mention that and forgot ;)

            1 Reply Last reply Reply Quote 0
            • First post
              Last post

            Products

            • Platform Overview
            • TNSR
            • pfSense
            • Appliances

            Services

            • Training
            • Professional Services

            Support

            • Subscription Plans
            • Contact Support
            • Product Lifecycle
            • Documentation

            News

            • Media Coverage
            • Press
            • Events

            Resources

            • Blog
            • FAQ
            • Find a Partner
            • Resource Library
            • Security Information

            Company

            • About Us
            • Careers
            • Partners
            • Contact Us
            • Legal
            Our Mission

            We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

            Subscribe to our Newsletter

            Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

            © 2021 Rubicon Communications, LLC | Privacy Policy