ipfw blocking routing between LAN and WAN



  • Hi all

    I spend days trying to debug a problem with not being able to route traffic between the LAN and WAN interface. I disabled the firewall (which is using FreeBSD pf) to see if it was a firewall rule and this didn't help.

    I then found that flushing the ipfw rules (ipfw flush) fixed the problem. I see ipfw is being used for the captive portal setup. My system does use a captive portal. Interestingly if I do an ipfw flush and then restart the captive portal then everything is fine.

    I did a diff between the ipfw rules when the system booted and after flushing and restarting the firewall and there are 3 lines that are different - I've marked them with stars - the clue to the problem seems to be here:

    *01000 skipto tablearg ip from any to any via table(cp_ifaces)
    *01100 allow ip from any to any
    02100 pipe tablearg ip from any to any MAC table(inethimesh_pipe_mac)
    02101 allow pfsync from any to any
    02102 allow carp from any to any
    02103 allow ip from any to any layer2 mac-type 0x0806,0x8035
    02104 allow ip from any to any layer2 mac-type 0x888e,0x88c7
    02105 allow ip from any to any layer2 mac-type 0x8863,0x8864
    02106 deny ip from any to any layer2 not mac-type 0x0800,0x86dd
    02107 allow ip from any to table(inethimesh_host_ips) in
    02108 allow ip from table(inethimesh_host_ips) to any out
    02109 allow ip from any to 255.255.255.255 in
    02110 allow ip from 255.255.255.255 to any out
    02111 pipe tablearg ip from table(inethimesh_allowed_up) to any in
    02112 pipe tablearg ip from any to table(inethimesh_allowed_down) in
    02113 pipe tablearg ip from table(inethimesh_allowed_up) to any out
    02114 pipe tablearg ip from any to table(inethimesh_allowed_down) out
    02115 pipe tablearg ip from table(inethimesh_auth_up) to any layer2 in
    02116 pipe tablearg ip from any to table(inethimesh_auth_down) layer2 out
    02117 fwd 127.0.0.1,8002 tcp from any to any 80 in
    02118 allow tcp from any to any out
    02119 skipto 65534 ip from any to any
    *65534 deny ip from any to any
    65535 allow ip from any to any

    Thanks
    David



  • Sorry stupid me

    I was trying to route traffic from a specific server on the LAN that was also behind the captive portal. All I had to do was add the IP address exclusion on the captive portal and it allowed that server through.

    Well at least I now understand the inner workings of pfsense and how pfsense uses a combination of pf and ipfw :) I'm actually curious why everything wasn't done in pf

    David