Newb Q: allow traffic between two interfaces
-
We have 2 interfaces, one of them has printers and a file server that the other one cannot access.
How can I make a firewall rule to allow traffic from the other one to the printers & server?
Or is it something else I need to do? Open ports, or?
-
Create a firewall rule on the interface the traffic will first enter pfsense to go where you want it to go. For example out of the box the lan firewall rules are any any.. so lan can go anywhere.
But if you create a new interface opt1, it will have no rules. so you could create a simple any any rule to get things working. And then lock down these rules to only allow the traffic you want based upon either source IP to dest IP, or dest Port, or protocol or combo like tcp port 9100 is a common printing port. So you could say source IP 1.2.3.4 can only talk to dest IP 4.5.6.7 via tcp port 9100, etc..
-
Thank you!
I created these rules, but I think I'm missing something?
I want CastleBlack to be able to connect to the resources of CP. It can go both ways, too.
-
dude for what possible reason would you put a any any in floating? Do you just wan to route and not firewall?
Your any any rule in castleblack would let it go anywhere, yes even cp - but maybe you have software firewall on devices in CP that block it?
-
Just a desperate attempt, really.
I can ping devices on CB but what I really want is to share the printers and a file server so that CB can access them.
How can I do this? What am I missing?
Do I have to get to the printers and server and manually set them up to somehow serve both interfaces?
Is there a way around this through pfSense?Thanks a lot in advance!
-
dude if your firewall rules are any any on the interface your trying to access your printers/servers on cb from then all traffic would be allowed. your servers are prob running a firewall that would print the access your trying. You would need to also adjust the firewall on the servers to allow the traffic from the network your coming from.
As to your printers. If you can ping them and you should be able to print to them. How are you trying to add them to what your printing from? You will not be able to broadcast for them. You would have to add their IP to what your trying to print from or have dns setup to allow for them to be added via their name that resolves to their IP. Are you trying to use something like airprint to add them? If so that does not work across networks. You would have to setup say avhai to be able to find them or again setup their IP or name that resolves to their IP in what your trying to print from.
-
Alright so then, I'm done with pfSense, I need to get to the devices individually.
Should I delete the rule in floating, then?The server is SunOS, old version. Then, I need to configure its firewall.
The printers are just regular printers which the guys are accessing from their PCs, Windows device finder. There is no central program I'm using to configure them.
I was hoping to broadcast for them on both networks, so the guys would see them by searching for devices.You Avahi suggestion seems promising, maybe I could use that.
-
If your machines are in windows AD then if your printers are in AD they will find them. In a work setup why would you not be using a print server anyway? Why would uses be directly wanting to add printers to their machines?
-
Machines aren't in Windows AD, we have no Windows servers.
It's a small company - with no IT department except for now, me :) inherited all this and I'm trying to make sense of the whole thing.The only server we have is this SunOS file server.
I will look into the idea of a print server - this doesn't exist here.
But so far, users just find the printers connected to the network and print there.
It seemed to work fine until now, when I need to give access to the server and printers to CB. -
" users just find the printer"
How do they "find" the printers? Why would they not just add the name of the printer which should resolve to the IP of the printer. Expecting to broadcast or use say airprint/mdns to find the printer only works when everyone is on the same layer 2 network.
-
I mean, in CP, printers are discoverable.
Thanks for the tip, will try that tomorrow.
There's a LOT to learn ahead. -
well yeah in same layer 2 network you can broadcast for name or use mdns to find the names if like airprint or something. When you cross networks you can not do such things. So you either resolve via dns, or you could setup your ns to do mdns and point to the correct IPs or you could use something like avhai to proxy that across subnets.
-
Will try to resolve through DNS first and see how that goes. I reckon this might turn out easier than handling the SunOS firewall