ipfw blocking routing between LAN and WAN
-
Hi all
I spend days trying to debug a problem with not being able to route traffic between the LAN and WAN interface. I disabled the firewall (which is using FreeBSD pf) to see if it was a firewall rule and this didn't help.
I then found that flushing the ipfw rules (ipfw flush) fixed the problem. I see ipfw is being used for the captive portal setup. My system does use a captive portal. Interestingly if I do an ipfw flush and then restart the captive portal then everything is fine.
I did a diff between the ipfw rules when the system booted and after flushing and restarting the firewall and there are 3 lines that are different - I've marked them with stars - the clue to the problem seems to be here:
*01000 skipto tablearg ip from any to any via table(cp_ifaces)
*01100 allow ip from any to any
02100 pipe tablearg ip from any to any MAC table(inethimesh_pipe_mac)
02101 allow pfsync from any to any
02102 allow carp from any to any
02103 allow ip from any to any layer2 mac-type 0x0806,0x8035
02104 allow ip from any to any layer2 mac-type 0x888e,0x88c7
02105 allow ip from any to any layer2 mac-type 0x8863,0x8864
02106 deny ip from any to any layer2 not mac-type 0x0800,0x86dd
02107 allow ip from any to table(inethimesh_host_ips) in
02108 allow ip from table(inethimesh_host_ips) to any out
02109 allow ip from any to 255.255.255.255 in
02110 allow ip from 255.255.255.255 to any out
02111 pipe tablearg ip from table(inethimesh_allowed_up) to any in
02112 pipe tablearg ip from any to table(inethimesh_allowed_down) in
02113 pipe tablearg ip from table(inethimesh_allowed_up) to any out
02114 pipe tablearg ip from any to table(inethimesh_allowed_down) out
02115 pipe tablearg ip from table(inethimesh_auth_up) to any layer2 in
02116 pipe tablearg ip from any to table(inethimesh_auth_down) layer2 out
02117 fwd 127.0.0.1,8002 tcp from any to any 80 in
02118 allow tcp from any to any out
02119 skipto 65534 ip from any to any
*65534 deny ip from any to any
65535 allow ip from any to anyThanks
David -
Sorry stupid me
I was trying to route traffic from a specific server on the LAN that was also behind the captive portal. All I had to do was add the IP address exclusion on the captive portal and it allowed that server through.
Well at least I now understand the inner workings of pfsense and how pfsense uses a combination of pf and ipfw :) I'm actually curious why everything wasn't done in pf
David