Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfSense blocking between VLANs - Unable to block due to "default rule"

    Scheduled Pinned Locked Moved Firewalling
    10 Posts 3 Posters 978 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      tehknowledge
      last edited by

      I have the SG-2220 unit with pfSense 2.3.3 p1. I have three interfaces set up (two are VLANs). WAN, LAN (vlan), GUEST(vlan)) as well as NAT enabled.

      I have the GUEST with the first rule as "block ALL to LAN net". The next rules are allow http anywhere, and allow https anywhere.

      From the GUEST network, I can connect to a web server on the LAN network using 80 without issues. Why is it not being blocked?

      The logs show that it is using the default 'allow firewall to any' being used as well as the "allow http anywhere". I also tried adding a rule on the LAN to block any traffic from GUEST net (first rule).  I also tried a floating rule to no avail.

      Any ideas? My thoughts are that it is using the NAT component to leverage the default allow firewall to get to the LAN network. I have not changed anything in the NAT area. As a workaround, I am forced to use iptables to block the traffic on the actual endpoint. However, I have some devices (like a NAS) that I cannot do this with.

      Thanks
      Scott

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        Please post what you actually have done and not a summary of what you think you have done.

        It would be blocked if it was done right or there is some other design issue in play.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • T
          tehknowledge
          last edited by

          thanks. I will update this evening when I have local access to the network. I am currently remote and based my question on memory and not actual screenshots/etc. Stay tuned..

          1 Reply Last reply Reply Quote 0
          • T
            tehknowledge
            last edited by

            Attaching screenshots here. I was able to find a cafe and got VPN access.

            ![1 NAT configuration.PNG](/public/imported_attachments/1/1 NAT configuration.PNG)
            ![1 NAT configuration.PNG_thumb](/public/imported_attachments/1/1 NAT configuration.PNG_thumb)
            ![2 LAN Rules.PNG](/public/imported_attachments/1/2 LAN Rules.PNG)
            ![2 LAN Rules.PNG_thumb](/public/imported_attachments/1/2 LAN Rules.PNG_thumb)
            ![3 GUEST network.PNG](/public/imported_attachments/1/3 GUEST network.PNG)
            ![3 GUEST network.PNG_thumb](/public/imported_attachments/1/3 GUEST network.PNG_thumb)

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by

              "Any ideas"

              you sure your not hitting a wan IP that is reflected back in?

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • T
                tehknowledge
                last edited by

                I am on a linux box on the guest network and doing a 'wget' to the IP in the LAN network. Firewall log attached to this email.

                ![Screenshot from 2017-03-23 14-51-41.png](/public/imported_attachments/1/Screenshot from 2017-03-23 14-51-41.png)
                ![Screenshot from 2017-03-23 14-51-41.png_thumb](/public/imported_attachments/1/Screenshot from 2017-03-23 14-51-41.png_thumb)

                1 Reply Last reply Reply Quote 0
                • T
                  tehknowledge
                  last edited by

                  The counter on the block rule keeps incrementing as well. You would think that means it is being hit.

                  1 Reply Last reply Reply Quote 0
                  • T
                    tehknowledge
                    last edited by

                    I think I might have a fix now after reading a lot of articles and thinking. I changed the Drop ALL from GUEST to "LAN net" to be "Drop ALL from GUEST to <subnet of="" lan="" network="">"

                    Example: Drop ALL from GUEST to 192.168.10.0/24 instead of using LAN net (which is 192.168.10.0/24).

                    I can no longer connect</subnet>

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      They are synonymous in the rule set. Whatever fixed it wasn't that.

                      You should block all to "This Firewall" after that DNS rule as johnpoz was alluding to.

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • T
                        tehknowledge
                        last edited by

                        I just had a big D'OH! moment. Sorry for wasting your time. My LAN network on the firewall is a DMZ, which has a router in front of my real LAN network.

                        PFSENSE <–--LAN net(192.168.100.x)----> WirelessRouter <----- Actual LAN net (192.168.10.x)

                        PF was seeing the LAN net, but I mistook the understanding of the LAN net I use. My bad.

                        Sorry again.. But glad it is not the firewall but the pebkac..

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.