Best way to isolate an IP from everything BUT the internet



  • Hello,

    Trying to figure out the best way to have my IoT devices segmented.  What is the easiest method?  If just using a firewall, would i create a deny rule and then a pass rule from the lan to the wan interface?  What about if i went the vlan route?

    My network is setup as a double Nat.  See attached.

    Thanks!



  • LAYER 8 Netgate

    Create another interface. VLAN or physical.

    Put your IoT devices on that.

    Pass the local traffic they need access to (DNS resolver, etc)
    Block the traffic you do not want them to have access to (LAN Net, This Firewall etc.)
    Pass traffic to any (The Internet is not destination WAN net it is destination any.

    Something like the attached. You might be able to get away with defining an RFC1918 alias instead of local nets containing 192.168.0.0/16, 172.16.0.0/12 and 10.0.0.0/8. You will likely need to maintain an alias of local IPv6 you wish to block though as those are generally all routable addresses.

    If you wish to keep them on the same subnet, you would need your switch to isolate the ports. Many can do so. That must be done in the switch since same-subnet traffic is not routed so the firewall never even sees it.

    ![Screen Shot 2017-08-06 at 2.26.11 PM.png](/public/imported_attachments/1/Screen Shot 2017-08-06 at 2.26.11 PM.png)
    ![Screen Shot 2017-08-06 at 2.26.11 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2017-08-06 at 2.26.11 PM.png_thumb)



  • ahh so i cant do this in pfsense.  I HAVE to do it in the switch if i want to keep it on the same subnet?

    I was thinking this might work to block 10.0.1.2 from everything but the internet but it does not.  Maybe i will try the vlan option.  WHen you say create another interface, would that require more ports on the pfsense?  Or is this more virtual?

    Thanks.

    ![ss firewallrules.png](/public/imported_attachments/1/ss firewallrules.png)
    ![ss firewallrules.png_thumb](/public/imported_attachments/1/ss firewallrules.png_thumb)



  • ^What he says.

    Why bother with rules, taking up more cpu bandwidth and complicate your rules table when you can do this at the hardware level.


  • LAYER 8 Netgate

    Same subnet traffic is not processed by the firewall at all. This is fundamental IP networking/routing.

    You can create a VLAN on the existing interface and set it to tagged on the switch.

    If igb1 goes to the switch:

    Create VLAN 20 on igb1 Interfaces > Assignments, VLANs

    Interfaces > Assignments and create new OPTX interface using VLAN 20 on igb1

    Edit the interface, enable it, number it, enable a DHCP server for it, etc.

    Create a pass any any firewall rule on OPTX

    Tag VLAN 20 on the switch port going to igb1

    Put a switchport untagged on VLAN 20

    Connect a test device to it. Be sure you get an address in the correct scope, can get out to the internet, etc.

    Tighten the firewall rules as described above.



  • @Derelict:

    Same subnet traffic is not processed by the firewall at all. This is fundamental IP networking/routing.

    You can create a VLAN on the existing interface and set it to tagged on the switch.

    If igb1 goes to the switch:

    Create VLAN 20 on igb1 Interfaces > Assignments, VLANs

    Interfaces > Assignments and create new OPTX interface using VLAN 20 on igb1

    Edit the interface, enable it, number it, enable a DHCP server for it, etc.

    Create a pass any any firewall rule on OPTX

    Tag VLAN 20 on the switch port going to igb1

    Put a switchport untagged on VLAN 20

    Connect a test device to it. Be sure you get an address in the correct scope, can get out to the internet, etc.

    Tighten the firewall rules as described above.

    Ok i have a new inteface for vlan on opt1.  But i dont see an option to enable dhcp for that interface.  On the interfaces page i do have dhcp enabled.



  • LAYER 8 Netgate

    Services > DHCP Server

    I didn't outline every click necessary.



  • @Derelict:

    Services > DHCP Server

    I didn't outline every click necessary.

    Yes, my screenshot was from that page.  It only gives me the option to adjust the LAN interface.


  • LAYER 8 Netgate

    Then you hosed up the numbering of the new OPTX interface. You probably set a /32 netmask there.



  • @Derelict:

    Then you hosed up the numbering of the new OPTX interface. You probably set a /32 netmask there.

    I used a /24.

    Any other ideas?



  • LAYER 8 Netgate

    You need to statically set annb address on the new interface to the new subnet you want on that interface. Do it just like LAN.



  • @Derelict:

    You need to statically set annb address on the new interface to the new subnet you want on that interface. Do it just like LAN.

    So you mean i should use /32?


  • LAYER 8 Netgate

    No.

    You are making a new subnet on a new interface. You need to number the interface then create a DHCP server.

    Example interface configuration attached.




  • @Derelict:

    No.

    You are making a new subnet on a new interface. You need to number the interface then create a DHCP server.

    Example interface configuration attached.

    Thanks!  The static ip did the trick. Ok.  So i have the opt interface configured.  DHCP configured.  the computer plugged into the opt1 port on the sg-3100.  But it will not pull an IP address.  Static does not allow it to connect to anything either.

    Any ideas?

    ![ss opt1.png](/public/imported_attachments/1/ss opt1.png)
    ![ss opt1.png_thumb](/public/imported_attachments/1/ss opt1.png_thumb)
    ![dhcp ss.png](/public/imported_attachments/1/dhcp ss.png)
    ![dhcp ss.png_thumb](/public/imported_attachments/1/dhcp ss.png_thumb)


  • LAYER 8 Netgate

    Did you make a VLAN or not?

    When the device is connected to the port does the status go to up in Status > Interfaces?

    You have protocols TCP and UDP on your firewall rule. That will not pass pings, for instance. Change that to protocol any unless you can articulate why you need just TCP/UDP.

    https://doc.pfsense.org/index.php/Connectivity_Troubleshooting



  • @Derelict:

    Did you make a VLAN or not?

    When the device is connected to the port does the status go to up in Status > Interfaces?

    You have protocols TCP and UDP on your firewall rule. That will not pass pings, for instance. Change that to protocol any unless you can articulate why you need just TCP/UDP.

    https://doc.pfsense.org/index.php/Connectivity_Troubleshooting

    Yes i made a VLAN when first started.  Used 320 as the ID.  Also the interface shows as up.



  • LAYER 8 Netgate

    Then you have to tag the traffic with VLAN ID 320. You mighht be able to do that in the NIC settings on your computer, but it would probably be easier to connect it to a switch that is configured for TAGGED VLAN 320, then connect your test device to a port on the switch that is UNTAGGED for VLAN 320.



  • @Derelict:

    Then you have to tag the traffic with VLAN ID 320. You mighht be able to do that in the NIC settings on your computer, but it would probably be easier to connect it to a switch that is configured for TAGGED VLAN 320, then connect your test device to a port on the switch that is UNTAGGED for VLAN 320.

    Im using a SG-3100.  How can i do that with this hardware?


  • LAYER 8 Netgate

    Post your Interfaces > Assignments screen

    And Interfaces > Switches, Ports

    And Interfaces > Switches, VLANs



  • @Derelict:

    Post your Interfaces > Assignments screen

    And Interfaces > Switches, Ports

    And Interfaces > Switches, VLANs

    posted.  Thanks again for the help here.





    ![interface assignments.png](/public/imported_attachments/1/interface assignments.png)
    ![interface assignments.png_thumb](/public/imported_attachments/1/interface assignments.png_thumb)


  • LAYER 8 Netgate

    You cannot do it in the switch there. mvneta0 is not part of the built-in switch. If you really want to use that OPT1 port, and don't want to hassle the VLAN or put a switch on it, then just change the assignment for  OPT1 to mvneta0 instead of VLAN 320 on mvneta0 and it will start working.



  • @Derelict:

    You cannot do it in the switch there. mvneta0 is not part of the built-in switch. If you really want to use that OPT1 port, and don't want to hassle the VLAN or put a switch on it, then just change the assignment for  OPT1 to mvneta0 instead of VLAN 320 on mvneta0 and it will start working.

    ok perfect.  That worked.  So let me ask you one last question.  If i wanted to do this for one of my LAN ports, is that possible?  Or is my best best connecting a switch to the opt1 port and using that for anything i want segmented from the rest of the network?

    Thanks again.


  • LAYER 8 Netgate

    You could tweak the switch into doing what you want by putting it in dot1q mode with VLAN 320 on mvneta0, then configuring the switch to be tagged on port 5 and untagged on one of the 4 edge ports.

    But if you're happy with how you have it just connect OPT1 to a switch (managed or unmanaged) and connect all of the devices you want on that network to that switch.


Log in to reply