Problem with firewall rule

  • I have a lan interface with the static IPv4 configuration of IPv4 address

    I have a lan firewall rule enabled as follow:

    block IPV4 TCP source ip any port destination !LAN net any port any gateway no schedule

    I am running Squid on pfsense and when I configure Internet Explorer to use the proxy at then pfsense blocks it with this message:

    @100(xxxxx) block drop in log quick on xn0 inet proto tcp from to ! flags S/SA label "block internet from specific desktop"

    Why is the rule blocking the packets, I am going to the lan interface of pfsense whose ip is within the lan net Is it that pfsense definition of LAN net excludes its own lan ip address?  Is this documented somewhere?  Why does the message not say that.

    Any help welcomed.

    I had to add an allow rule for pfsense LAN ip ahead of the previous rule for this to work.

  • LAYER 8 Global Moderator

    post up your full lan rules.. Ie screenshot.

    And your using transparent proxy or explict?  If you don't want internet on user and your using proxy its best to block in the proxy as well as rules.

Log in to reply