Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Guest VLAN isolated from Management LAN: rules to keep Internet access?

    Scheduled Pinned Locked Moved Firewalling
    16 Posts 5 Posters 2.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by

      So you don't want this vlan 99 to access any of your other networks?  Which I assume are all rfc1918 space..  Do want this vlan to be able to access anything on pfsense at all?

      You rules could be done in 2 rules - Derelict doesn't like to do it this way… ;)  But it is another way to skin the cat...

      So leave your redirect rule there.. But vs doing an any any rule, you can get rid of all of those block rules and change your any any rule to a ! (not) rfc1918 rule..

      Create an alias, put in 10/8, 192.168/16, 172.16/12 this makes up the rfrc1918 space which all your other vlans are on..  Then on your any any rule just make it ! rfc1918 alias.. So if dest is anything rfc1918 from this vlan it would not be allowed and blocked by the default rule.  If ie a public IP address then it would be allowed..

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        Reject to dest rfc1918 then pass any. :)

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          Yup that works too - see lots of ways to skin the cat ;)

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            Only one right way though. :)

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by

              heheheeh - ROFL…. The Derelict way ;) heheheeh

              What if combine your reject to rfc above my ! rfc allow rule?  Would that be ok? ;)

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

              1 Reply Last reply Reply Quote 0
              • V
                Velcro
                last edited by

                Not trying to stir the pot but thanks Johnpoz and Derelict for the options but what is the real difference?

                is the thinking that "! RFC1918" is potentially "leakable"? Is there a way to quantify the difference? When would one use the "!"?

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by

                  I think awhile back there was some sort of issue with the not rules.. But as always you should always validate any sort of rules you put in place are actually working the way you believe they should work, etc.

                  Derelict method of actual bock makes the rules more clear cut and obvious to yes no function.  I believe he is of the mind set you do not block with an allow statement - but I do not see it that way.  Not blocking anything with that rule, the default block is what blocks.  I am just being more restrictive on my allow.

                  We have over the years gone round a few times on this - we agree to disagree if you will ;)  I do see his point clear blocks in your rules, and am a fan of that..  I don't see anything wrong with doing it that way.  But I am also a fan of min amount of rules to accomplish the goal..

                  Derelict please chime in on your take on it.. It has been a while since we have discussed this ;) heheheh

                  I don't see it right/wrong way, just a different way to skin the same cat is all.  If you had a bunch of networks to block your rules list could get quite long… Sure you could put your networks into a alias..  You really need to understand the specifics of setup, ie the breed of the cat if you will to know which way to skin might be the best option.

                  If your a fan or watch silicon valley... Its like tabs vs spaces ;)

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    If you want to block traffic, block it. Don't rely on pass rules to block traffic. Particularly pass ! rules.

                    https://redmine.pfsense.org/issues/6799

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      See that where are difference is… That rule is not blocking anything.. Its just a specific allow vs any.. The block is default block.. Your against specific allow rules? ;)

                      Agree to disagree as said ;)

                      That redmine entry should never happen to be honest, because that sort of setup is just full blown borked of running multiple layer 3 on the same layer 2....  As I stated you should always validate your rules are working as expected..

                      So you see no use for the ! at all in a destination? Or source - you don't think it should be an option at all?

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        The default pfBlocker DNSBL config creates that scenario.

                        I am not against specific pass rules to pass traffic that is to be passed allowing fall-through to the default deny.

                        I am against using a pass rule to ! something expecting it to function as a block rule for something.

                        If you want to block it, block it with a block rule.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          Which is borked ;)  If he wants to listen on a address - then create a vip in the network.. Not some 10.10.10 address or whatever it uses out of the box..

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            I agree. That vip should be on localhost.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.