Problem with firewall rule
-
I have a lan interface with the static IPv4 configuration of IPv4 address 10.0.0.2/24.
I have a lan firewall rule enabled as follow:
block IPV4 TCP source ip 10.0.0.25 any port destination !LAN net any port any gateway no schedule
I am running Squid on pfsense and when I configure Internet Explorer to use the proxy at 10.0.0.2:3128 then pfsense blocks it with this message:
@100(xxxxx) block drop in log quick on xn0 inet proto tcp from 10.0.0.25 to !10.0.0.0/24 flags S/SA label "block internet from specific desktop"
Why is the rule blocking the packets, I am going to the lan interface of pfsense whose ip 10.0.0.2 is within the lan net 10.0.0.0/24? Is it that pfsense definition of LAN net excludes its own lan ip address? Is this documented somewhere? Why does the message not say that.
Any help welcomed.
I had to add an allow rule for pfsense LAN ip ahead of the previous rule for this to work.
-
post up your full lan rules.. Ie screenshot.
And your using transparent proxy or explict? If you don't want internet on user and your using proxy its best to block in the proxy as well as rules.