Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Block Communication between intefaces

    Firewalling
    9
    14
    1151
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      ncage last edited by

      Hi everyone. I have two internal interfaces on my pfsense rig (LAN & OPT1). I just had the need for the OPT1 interface the other day so i went through the learning process of enabling it which wasn't to bad. Though i have it working the way i want i can't stop thinking i don't have it setup optimally. When i went to setup the firewall rules for the OPT1 interface (because i don't want opt1 to  be able to communicate with LAN) this is how is set it up:

      Action: Pass
      Interface: OPT1
      Address Family: IPV4+IPV6
      Protocal: any
      Source: Opt1 Net
      Destination: Wan Net (tried Wan Address when this didn't work).

      Everyone going through OPT1 didn't have internet access.

      So i ended up changing Destination to 'Any' and then adding the following firewall rule:
      Action: Block
      Interface: OPT1
      Address Family: IPV4+IPV6
      Protocal: any
      Source: any
      Destination: Lan Net

      which seemed to achieved what i was after. So my basic questions are:
      1. Why did users connection through opt1 not have internet access with the way i had it setup previously
      2. Is the way i have it setup currently ok or is there a better way to set it up?

      I don't know if this matters but i have some confusion about the difference between 'Net' & 'Address'  so don't know if thats contributing to the problem or not but i plan to ask about this in a different thread.

      thanks…..

      1 Reply Last reply Reply Quote 0
      • ptt
        ptt Rebel Alliance last edited by

        1 - Because  "WAN Net" != "internet"

        1 Reply Last reply Reply Quote 0
        • KOM
          KOM last edited by

          2 - If you want to restrict access from OPT1 to LAN, then you need to change your Destination from any to ! (not) LAN net.

          1 Reply Last reply Reply Quote 0
          • Derelict
            Derelict LAYER 8 Netgate last edited by

            I don't like that technique.

            Block traffic to LAN net then Pass traffic to any.

            IMHO traffic should not be "blocked" with a pass rule.

            Something like this might happen: https://redmine.pfsense.org/issues/6799

            Chattanooga, Tennessee, USA
            The pfSense Book is free of charge!
            DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • KOM
              KOM last edited by

              Thanks. I didn't know that was the preferred method now but it makes sense.

              1 Reply Last reply Reply Quote 0
              • N
                ncage last edited by

                @ptt:

                1 - Because  "WAN Net" != "internet"

                Can you be more explicit? I always thought of the WAN side of any router type device as the internet. Where is my understanding flawed?

                thanks

                1 Reply Last reply Reply Quote 0
                • N
                  ncage last edited by

                  @Derelict:

                  I don't like that technique.

                  Block traffic to LAN net then Pass traffic to any.

                  IMHO traffic should not be "blocked" with a pass rule.

                  Something like this might happen: https://redmine.pfsense.org/issues/6799

                  From your description it sounds like the way i have it setup is just fine….

                  1 Reply Last reply Reply Quote 0
                  • Derelict
                    Derelict LAYER 8 Netgate last edited by

                    Yes as long as the block rule is placed above the pass rule.

                    Chattanooga, Tennessee, USA
                    The pfSense Book is free of charge!
                    DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • N
                      Nullity last edited by

                      @ncage:

                      @ptt:

                      1 - Because  "WAN Net" != "internet"

                      Can you be more explicit? I always thought of the WAN side of any router type device as the internet. Where is my understanding flawed?

                      thanks

                      WAN Net refers to the network (or single IP) that your WAN interface has.

                      Usually it is your WAN IP, as assigned from your ISP. Some ISPs offer multiple IPs.

                      Please correct any obvious misinformation in my posts.
                      -Not a professional; an arrogant ignoramous.

                      1 Reply Last reply Reply Quote 0
                      • P
                        P3R last edited by

                        @ncage:

                        Can you be more explicit? I always thought of the WAN side of any router type device as the internet. Where is my understanding flawed?

                        In a pass rule you can limit outgoing traffic to only a specific internet ip network and that is exactly what you do as the WAN Net is only the transit network leading to the rest of the internet. Your OPT1 clients would be able to send traffic to every node on the specific ip network that the WAN ip reside in but traffic with another destination address wouldn't be passed by that rule.

                        1 Reply Last reply Reply Quote 0
                        • johnpoz
                          johnpoz LAYER 8 Global Moderator last edited by

                          "WAN Net is only the transit network leading to the rest of the internet."

                          Exactly!!!!! I really just do not how people confuse wan net with "internet"  It says Wan Net right in the name, not All other networks not local ;)

                          You can think of the wan as the internet, but you have to understand that your connected to the internet via a transit network.. Not the whole freaking internet ;)

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                          1 Reply Last reply Reply Quote 0
                          • K
                            kpa last edited by

                            Internet = networks interconnected by using other networks that serve as these "transit networks". That may be hard to picture in your mind at first but once you start thinking along the lines of how you would connect your own LAN network at your home to another LAN network at your friend's house (assuming it's just a matter of laying a cable between them) and take that idea to a larger scale with multiple networks it should start making sense.

                            1 Reply Last reply Reply Quote 0
                            • H
                              Harvy66 last edited by

                              @johnpoz:

                              "WAN Net is only the transit network leading to the rest of the internet."

                              Exactly!!!!! I really just do not how people confuse wan net with "internet"  It says Wan Net right in the name, not All other networks not local ;)

                              You can think of the wan as the internet, but you have to understand that your connected to the internet via a transit network.. Not the whole freaking internet ;)

                              Being they use simplistic ideas of what's going on. They just memorize terms like "network" and assume it always means the exact same thing in all contexts until they run into an issue. I see the same thing all the time. Had a 10+ year storage admin who "knew" what thin provisioning meant, but didn't understand the implication when we said we needed to have a LUN backed by contiguous storage and gave us a thinly provisioned LUN. I wonder what the return policy is on a $200k SAN device that you've had for 2 months before you realized you can't control LUN layout.

                              1 Reply Last reply Reply Quote 0
                              • johnpoz
                                johnpoz LAYER 8 Global Moderator last edited by

                                "I wonder what the return policy is on a $200k SAN device that you've had for 2 months before you realized you can't control LUN layout."

                                hehehe oh that is funny… Did you pay for already?  Most companies float payment for atleast 90+ days ;)  Tell them it does not meet your requirements, and the person that ordered it has been flogged out back for it.. If they ever want any future business from you they will take it back or get the model that allows you to do what you want..

                                But I hear year, work with people that have been the field for years and years, and still don't get what amounts to basic concepts.. And then they are too scared to bring it up if having a discussion... So for example when you stated "we needed to have a LUN backed by contiguous storage" he could of just asked - and that means what exactly??

                                Been dealing quite a bit of late with just local switching stuff, and be amazed at how many people that have been doing it for years and years just don't quite grasp that a lagg or etherchannel/portchannel/etc  is not 1+1=2, but just 2 x 1 and 1, etc..  No specific device talking to another specific device across that will ever see more than 1, etc.

                                Had a whole augment with a architect how you can not replace a 6509 with a 4500x and some access switches in a stack.. And they were uplinking the stack to the 4500 with 1+1 lagg..  With no clue to what the intervlan traffic was and how that could be a bottleneck.. Their thought process was that the wan link is not even gig..  Sure if you wan to save some cost and there is NO intervlan traffic, then maybe.. Production facility you have to assume intervlan, and maybe quite a bit of it..  Atleast allow for each vlan to have an uplink so your not hairpinning, etc.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post