Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Critical issue with blocking LAN interfaces

    Scheduled Pinned Locked Moved Firewalling
    3 Posts 2 Posters 424 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      fireix
      last edited by

      Network is transparent bridge.

      WAN (public static IP) and no IP on other side (so NAT is disabled and no DHCP).

      LAN1, OPT1, OPT2 is bridged along with the WAN interface. All traffic between the three LAN port should be able to pass, it should really behave like a switch.

      I have a * all pass (even on protocol) on LAN, floating, OPT1, OPT2 and even a bridge interface (not on a port).

      FW have started to block a lot of the traffick on the LAN! For instance a host on LAN1 is denied access to a device on OPT1. I see this in the fw log. When I click Easy add rule and it is added, it is added under the Allow all on the LAN1 or whatever port it was blocked on. So it is already allowed.

      The deny message says it hits "default deny" rule. But there are no deny rule on any of the local interfaces and that easy add wizard adds a rule on that same interface and still gives no result should indicate that further.

      Traffic from all LAN out on WAN seems to work just perfect.

      Is there some kind of interface I have not added? I'm clueless. Any tips is highly appricaited!

      I click the last + sign in the image and then the rule goes to LAN_SW1 (LAN1), which is a local interface. Not that it helps, because I have the allow any just above it. Running latest  2.4.1-RELEASE (amd64).

      net.link.bridge.pfil_member = 0
      net.link.bridge.pfil_bridge = 1

      WAN, LAN1 (LAN_SW1), OPT1, OPT2=bridge0

      image1.png
      image1.png_thumb
      image2.png
      image2.png_thumb

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        "it should really behave like a switch."

        Sorry but then get a switch! ;)  So your wanting a transparent firewall - do you have any block rules?

        And your block there is a Ack.. So its out of state.. And yes wold be blocked.

        https://doc.pfsense.org/index.php/Why_do_my_logs_show_%22blocked%22_for_traffic_from_a_legitimate_connection

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • F
          fireix
          last edited by

          To introduce more things to manage introduces more risk (all is duplicated to avoid having to go to the datacenter in case of one line falls out - both power, network and two network interfaces in team-mode).

          When all I need is two ports, it is a bit drastic to buy enterprise switches into this (more rack-space, more cables, more outlets etc). I also have another pfSense SG-2440 (not for use in my network where I have tested the switching speed and found it to be more than good enough - I couldn't really see any delays introduced - I assume we are talking microseconds and not ms?).

          I have had the pfSense as transparent fw for two years, with only rules on the WAN-interface. The only change I have done, is to connect our second main switch to the second LAN-interface (called LAN_SW2 or physical port OPT1 of pfSense) instead of just having it serial-connected to just one main switch. So it is in parallell/redundancy-mode. We have RSTP thoughout on all switches.

          I do have block rules on the WAN-interface (against known bot-nets), but not against our own IPs and the WAN-interface shouldn't interfere with inter-LAN connections (unless there are something with this bridge-thing I migth have misunderstood).

          When it is out of state, could this be due to a network thing like above and that I should not look at pfSense to debug this error?

          In the attachment, you will see my interfaces and the bridge. I have just deleted (as you see on the image) the OPT3 virtual interface attached to the bridge in bridge.png, I assume it wasn't needed there in this setup as it didn't change anything.

          Update: I have run a commercial tool to detect duplicate IPs, and it found about 10 - but it was because they where in teams/bond/LAG-mode. Just to be sure, I have disabled one interface on every team and now it shows no duplicate ip. But still have problems.

          Update 2: Things looks more stable once I disabled the redundancy in teaming/bonding. Maybe an error in software-setup on one server unless you see any errors in my setup. This teaming feature seems to change mac-address often because of the balancing (alb), maybe pfSense or something is getting confused by this?

          bridge.png
          bridge.png_thumb
          ifaces.png_thumb
          ifaces.png

          1 Reply Last reply Reply Quote 0
          • First post
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.