Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Confused over rules

    Firewalling
    4
    13
    385
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • ?
      A Former User last edited by A Former User

      This post is deleted!
      1 Reply Last reply Reply Quote 0
      • Rico
        Rico LAYER 8 Rebel Alliance last edited by Rico

        Why should the Source of GUESTNETWORK net hit any Rule on your LAN2 Interface?
        Read here to understand how Firewall Rules work:
        https://www.netgate.com/docs/pfsense/firewall/firewall-rule-basics.html
        https://www.netgate.com/docs/pfsense/book/firewall/index.html

        -Rico

        1 Reply Last reply Reply Quote 0
        • johnpoz
          johnpoz LAYER 8 Global Moderator last edited by

          It's really simple

          Rules are evaluated top down as traffic enters the interface from the network its attached too.
          First rule that trigger wins
          No other rules are evaluated

          How would an IP from your Guestnetwork ever be source IP entering the lan2 interface from the lan2 network??

          1 Reply Last reply Reply Quote 0
          • ?
            A Former User last edited by A Former User

            This post is deleted!
            1 Reply Last reply Reply Quote 0
            • johnpoz
              johnpoz LAYER 8 Global Moderator last edited by johnpoz

              Huh? Source is ALWAYS going to be the network a interface is attached too... There will NEVER be a time that another network is a source network.. It would only be a destination network..

              Traffic is ALWAYS inbound to the interface from the network its attached to.. So lan 2 the source will always be Lan 2 net, lan the source will always be LAN.. Unless you have downstream networks and this interface is a transit the network source will always be the network of the interface....

              You make rules based upon the destination.. First rule to trigger wins, no other rules are evaluated..

              1 Reply Last reply Reply Quote 0
              • ?
                A Former User last edited by

                This post is deleted!
                1 Reply Last reply Reply Quote 0
                • johnpoz
                  johnpoz LAYER 8 Global Moderator last edited by

                  Rules are evaluated INBOUND to the interface.. Not outbound direction.

                  1 Reply Last reply Reply Quote 0
                  • ?
                    A Former User last edited by

                    This post is deleted!
                    1 Reply Last reply Reply Quote 0
                    • johnpoz
                      johnpoz LAYER 8 Global Moderator last edited by johnpoz

                      Dude are you trolling.... Nobody can be this dense...

                      INBOUND TO THE INTERFACE.. From the Network its attached to!!

                      Rules are not evaluated as traffic leaving an interface into a network.. Unless you use the floating rules tab and choose to do such a thing..

                      1 Reply Last reply Reply Quote 0
                      • M
                        mikeisfly last edited by

                        @johnpoz said in Confused over rules:

                        Huh? Source is ALWAYS going to be the network a interface is attached too... There will NEVER be a time that another network is a source network.. It would only be a destination network..

                        Traffic is ALWAYS inbound to the interface from the network its attached to.. So lan 2 the source will always be Lan 2 net, lan the source will always be LAN.. Unless you have downstream networks and this interface is a transit the network source will always be the network of the interface....

                        You make rules based upon the destination.. First rule to trigger wins, no other rules are evaluated..

                        While I see what you are saying this is not technically true, right? If I have a PfSense interface connected to another router and the traffic is routed, then the source IP could be a IP from a adjacent router right? Not trying to be picky just want to make sure that newbies have correct information.

                        1 Reply Last reply Reply Quote 0
                        • johnpoz
                          johnpoz LAYER 8 Global Moderator last edited by

                          @johnpoz said in Confused over rules:

                          Unless you have downstream networks and this interface is a transit the network source will always be the network of the interface....

                          Which is why I clearly stated the above..

                          I really don't know if this guy was trolling or what, but as soon as I stated that he deleted all his posts.

                          M 1 Reply Last reply Reply Quote 0
                          • M
                            mikeisfly @johnpoz last edited by

                            @johnpoz Sorry didn't see that. I yield sir.

                            1 Reply Last reply Reply Quote 0
                            • johnpoz
                              johnpoz LAYER 8 Global Moderator last edited by

                              You are correct though there are cases were the source IP would be different than the net the interface is connected to..

                              If this was the case any could be used as source, or restrictive cidr containing all your possible downstream... But there would never be a case where lan 2 was seen on lan 1 as source... Unless you had a LOOP and crossover between your L2 networks.. Which would be BAD! ;)

                              He was putting in his other networks as source.. Which would never be the case.

                              1 Reply Last reply Reply Quote 0

                              Products

                              • Platform Overview
                              • TNSR
                              • pfSense
                              • Appliances

                              Services

                              • Training
                              • Professional Services

                              Support

                              • Subscription Plans
                              • Contact Support
                              • Product Lifecycle
                              • Documentation

                              News

                              • Media Coverage
                              • Press
                              • Events

                              Resources

                              • Blog
                              • FAQ
                              • Find a Partner
                              • Resource Library
                              • Security Information

                              Company

                              • About Us
                              • Careers
                              • Partners
                              • Contact Us
                              • Legal
                              Our Mission

                              We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

                              Subscribe to our Newsletter

                              Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

                              © 2020 Rubicon Communications, LLC | Privacy Policy