Traffic between LAN and OPT

[esquire1968]

Hi!

I've 2 Networks: LAN (10.0.0.0/24) and OPT2 (10.0.88.0/24). I want to use OPT2 an a "guest-network" with no access to LAN.

It doesn't work. Any client in the OPT2-net can access clients in the LAN-net. Enclosed my rules an the message I get from den firewall.

What's wrong?

Thanks for your help!

Thomas

[Derelict]

Looks like it should work to me, though I really don't like blocking access with '!' rules. If you want to block it, just block it then pass everything else.

Are you sure you're not looking at traffic from old states? Reset states in Diagnostics > States and test again.

[esquire1968]

Hi and thank you for your advice. I reset the states but i doesn't work - same situation. Very strange! Any other ideas?

Maybe is this a part of the problem:

I found the same route 10.0.88.211:49411 -> 10.0.0.25:80 on the interface LAN and OPT2.
(10.0.88.211 is a client of OPT2)

Cheets,
Thomas

[Derelict]

Either you're not telling us something or something is not as it seems. I assume you are clicking on the pass action in the firewall logs to get that rule description. Please post the text of the logs and the rule description.

[newbie_sense]

Did you try to make a deny rule with opt1.net as source and lan.net as destination?

[MoonKnight]

Hi,

Try to make this rule under your OPT2

Just change my WLAN net to your OPT2 and my LAN_1 net to your LAN net


[johnpoz]

So these are 2 sep networks, your not running both of these networks plugged into the same dumb switch?  Ie multiple layer 3 networks over the same layer 2?

You don't have any rules in floating?

What are you accessing that your saying is not being blocked?

[esquire1968]

Hi!

Thank's for your tipps!

Enclosed you will find all my rules (WAN, LAN, OPT2, IPSEC, OPENVPN) - I haven't set any floating rules - the Firewall logs and the states.

LAN and OPT2 are connected with the same Switch (TP-Link TL-SG2216) but both ports are isolated.

@CiscoX: When I set a rule like your desciption [IPv4  *  OPT2 net  *  LAN net  *  *  None], the block from OPT2 to LAN works, but I've no access to the Intrenet.

Cheers
Thomas

[MoonKnight]

hi,

Try to make another rule that allow DNS port under OPT2 over your new block rule

[IPv4  TCP/UDP  OPT2 net  *  *  53(DNS)  *  None]

[johnpoz]

Well looks like its letting it in on that block ! lan net? But clearly it shouldn't since 10.0.0.25 is part of your lan net 10.0.0.0/24

So you flushed your states, your sure?  I use ! rules all the time and work just how they should.  If your going to block specific then your going to need a rule below it that allows internet, ie a any any rule, etc.

[esquire1968]

I tried to set an "any/any" rule after the "! LAN", but this rule comes not in action because the "! LAN" rule Reports:

… pass in log quick on em2 inet from 10.0.88.0/ to 10.0.0.0/24 flags S/SA Keep state Label "USER_RULE: block OPT2 to LAN"

Yes, I reset the states. It's so crazy!

@CiscoX: I tried it - no Internet Access!

Thomas

[georgeman]

If this is a guest network, I suggest to create an alias with all the RFC1918 ranges, and explicitely add a rule to block it. After that rule, you can pass internet traffic.

Still, what you posted is really strange

[johnpoz]

You got something going on that is for sure… To provide internet access and just block access to lan all should need is a ! lan_net rule..  Here for example is my guest network.

you can get a bit more fancy.  As mentioned the rfc1918 alias.

In my rules I allow ping ipv4&6, I allow dns to pfsense interface in guest
access to my printer.
I then block all other access to any IP on pfsense, ie wan IP for example which is why I use the firewall built in alias
I then allow to go anywhere that is not rfc1918, or anywhere that is not my local IPv6 networks via ! rule and alias.

Your mask shows 10.0.0/24 but you sure that took hold?  Or you go something odd..  I would blow away all rules on the interface..  make sure you can not access your other network or anything..  You should see your blocks in the default deny rule.  Then recreate you rules.

[Derelict]

This is going to end up being chickens from the "block traffic by passing everything to ! LAN net" coming home to roost.

If you want to block traffic, block it. Then pass everything else.

[johnpoz]

but that is not right, that rule should block traffic if its to his lan..  So what is the reason that the rule is not working?

[Derelict]

https://redmine.pfsense.org/issues/6799

[johnpoz]

So OP do you have a vip on your lan that is mentioned in the bug report?  And you just didn't mention it?

[Derelict]

Yes. More information was provided in a PM. It's not something that is immediately-apparent. And I believe, in this case, it was added by the pfBlockerNG package, which is another issue.

[johnpoz]

I knew that 10.10.10.10 address was familiar ;)  While I love the work bcan is doing with that package.. I am not a fan of some package auto creating rules for me..  and that 10.x address is broken setup when you do multiple layer3 on the same layer 2, etc.

If you want to run something serv up stuff for adblocking, etc.  Then have the user pick and actual IP in the network your using.

I wish he would just make a lite version that takes the great work he has done with putting IPs for geoips into aliases, etc.  I don't want any auto rules.  But having nice easy gui for creating aliases with info like IPs from specific countries is good stuff…  I can then use those aliases in the rules as I see fit, etc.