Confused over rules

This post is deleted!

Rico

Why should the Source of GUESTNETWORK net hit any Rule on your LAN2 Interface?
Read here to understand how Firewall Rules work:
https://www.netgate.com/docs/pfsense/firewall/firewall-rule-basics.html
https://www.netgate.com/docs/pfsense/book/firewall/index.html

-Rico

johnpoz

It's really simple

Rules are evaluated top down as traffic enters the interface from the network its attached too.
First rule that trigger wins
No other rules are evaluated

How would an IP from your Guestnetwork ever be source IP entering the lan2 interface from the lan2 network??

This post is deleted!

johnpoz

Huh? Source is ALWAYS going to be the network a interface is attached too... There will NEVER be a time that another network is a source network.. It would only be a destination network..

Traffic is ALWAYS inbound to the interface from the network its attached to.. So lan 2 the source will always be Lan 2 net, lan the source will always be LAN.. Unless you have downstream networks and this interface is a transit the network source will always be the network of the interface....

You make rules based upon the destination.. First rule to trigger wins, no other rules are evaluated..

This post is deleted!

johnpoz

Rules are evaluated INBOUND to the interface.. Not outbound direction.

This post is deleted!

johnpoz

Dude are you trolling.... Nobody can be this dense...

INBOUND TO THE INTERFACE.. From the Network its attached to!!

Rules are not evaluated as traffic leaving an interface into a network.. Unless you use the floating rules tab and choose to do such a thing..

mikeisfly

@johnpoz said in Confused over rules:

Huh? Source is ALWAYS going to be the network a interface is attached too... There will NEVER be a time that another network is a source network.. It would only be a destination network..

Traffic is ALWAYS inbound to the interface from the network its attached to.. So lan 2 the source will always be Lan 2 net, lan the source will always be LAN.. Unless you have downstream networks and this interface is a transit the network source will always be the network of the interface....

You make rules based upon the destination.. First rule to trigger wins, no other rules are evaluated..

While I see what you are saying this is not technically true, right? If I have a PfSense interface connected to another router and the traffic is routed, then the source IP could be a IP from a adjacent router right? Not trying to be picky just want to make sure that newbies have correct information.

johnpoz

@johnpoz said in Confused over rules:

Unless you have downstream networks and this interface is a transit the network source will always be the network of the interface....

Which is why I clearly stated the above..

I really don't know if this guy was trolling or what, but as soon as I stated that he deleted all his posts.

mikeisfly

@johnpoz Sorry didn't see that. I yield sir.

johnpoz

You are correct though there are cases were the source IP would be different than the net the interface is connected to..

If this was the case any could be used as source, or restrictive cidr containing all your possible downstream... But there would never be a case where lan 2 was seen on lan 1 as source... Unless you had a LOOP and crossover between your L2 networks.. Which would be BAD! ;)

He was putting in his other networks as source.. Which would never be the case.