Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Configure 3 lan in pfsense

    Cache/Proxy
    4
    42
    624
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      ab96 last edited by

      Good day I'm setting up 3 lan, the first one blocks the content I want but the others do not block me I'm using squidguard in pfsense are 2 new interfaces. !!

      1 Reply Last reply Reply Quote 0
      • A
        akuma1x last edited by

        So... what's your question?

        Jeff

        A 1 Reply Last reply Reply Quote 0
        • A
          ab96 @akuma1x last edited by

          @akuma1x How do I get internet and block content on the other 2 LANs? already configure the squidguard to block but it does not :(

          1 Reply Last reply Reply Quote 0
          • A
            akuma1x last edited by akuma1x

            For this example, let's say your lans are called LAN, LAN2, and LAN3.

            You need to add firewall rules for each of the interfaces, whether they be physical or virtual. This 1 simple rule (for IPv4 or IPv6) will allow traffic to pass to the internet (out thru your default gateway). The rule is as follows (sorry, it's an old version of pfsense, but still applies):

            031716_1614_pfSenseSeri2.png

            During your initial setup, on whatever interface you pick as LAN, these rules are auto-created. You can recreate them, or duplicate them, for your other interfaces very easily. But, they have to be there, or no traffic moves out of that particular network.

            And, since we're talking about making firewall rules, here's a good summary on what all the terms mean in the "source" and "destination" drop down menus. If you're wondering...

            https://docs.netgate.com/pfsense/en/latest/firewall/firewall-rule-basics.html

            Finally, you might need to reboot the pfsense box after you fiddle with all these settings. It never hurts.

            Hope that helps!

            By the way, I don't use squidguard, so I can't comment on how that might be affecting this problem, or not.

            Jeff

            A 1 Reply Last reply Reply Quote 0
            • A
              ab96 @akuma1x last edited by

              @akuma1x thank you, I could already with 2 lan !!!

              1 Reply Last reply Reply Quote 0
              • johnpoz
                johnpoz LAYER 8 Global Moderator last edited by

                @akuma1x sure hope you pulled that picture from somewhere... That is OLD... your not running that version of pfsense are you?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                A 1 Reply Last reply Reply Quote 0
                • A
                  akuma1x @johnpoz last edited by

                  @johnpoz No, I'm running current 2.4.4p2 on all my gear.

                  But, when I went to search for an image of the default LAN rules, it only shows old pfsense versions, apparently. Try it, do a search for "pfsense default lan rules" and check the images that it finds. I was only looking for the 2 default rules, nothing additional. So, I simply posted what I found.

                  I should have just screenshot'ted my own setup, but I've got some extra rules on my LAN interface besides default stuff.

                  Jeff

                  1 Reply Last reply Reply Quote 0
                  • johnpoz
                    johnpoz LAYER 8 Global Moderator last edited by johnpoz

                    quick google found this ;)
                    alt text

                    But yeah lots of OLD stuff comes up as well ;)

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                    A A 2 Replies Last reply Reply Quote 0
                    • A
                      ab96 @johnpoz last edited by

                      @johnpoz I did it like that jejej the version is 2.4.4 thank you !!

                      1 Reply Last reply Reply Quote 0
                      • A
                        akuma1x @johnpoz last edited by akuma1x

                        @johnpoz doh, look at that! Picture option number 2, my bad...

                        Jeff

                        A 1 Reply Last reply Reply Quote 0
                        • A
                          ab96 @akuma1x last edited by

                          @akuma1x It is only configured there for internet access, because it does not have internet access anymore, mmm something is wrong here :o :( Thanks for your help

                          1 Reply Last reply Reply Quote 0
                          • stephenw10
                            stephenw10 Netgate Administrator last edited by

                            Do you have Squid set to listen on those new interfaces?

                            Steve

                            A 1 Reply Last reply Reply Quote 0
                            • A
                              ab96 @stephenw10 last edited by

                              @stephenw10 I did it like that 1.JPG 1.3.JPG 1.2.JPG

                              1 Reply Last reply Reply Quote 0
                              • stephenw10
                                stephenw10 Netgate Administrator last edited by

                                Hmm, OK do you see hits in the squid access log from clients on all 3 interfaces?

                                If so the Squidguard ACLs are probably not set for all three subnets as sources.

                                Steve

                                A 1 Reply Last reply Reply Quote 0
                                • A
                                  ab96 @stephenw10 last edited by

                                  @stephenw10 And why does not squidguard block the list that I have assigned :( ?? and how do I configure that?

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10
                                    stephenw10 Netgate Administrator last edited by

                                    See my last question ^. Is squid showing it's proxying that traffic?

                                    Is Squidguard configured to filter traffic from all three subnets?

                                    Steve

                                    A 2 Replies Last reply Reply Quote 0
                                    • A
                                      ab96 @stephenw10 last edited by

                                      @stephenw10 Yes I do it

                                      1 Reply Last reply Reply Quote 0
                                      • A
                                        ab96 @stephenw10 last edited by

                                        @stephenw10 Captura1.JPG Captura2.JPG

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10
                                          stephenw10 Netgate Administrator last edited by

                                          Your group ACL there only contains 15 IPs. Is that the group that should be allowed access to any site?

                                          What targets do you have set there?

                                          What do you have in the Common ACLs?

                                          Do you actually see traffic from all three subnet in the Squid RealTime logs to show they are all being proxied?

                                          Steve

                                          A 1 Reply Last reply Reply Quote 0
                                          • A
                                            ab96 @stephenw10 last edited by

                                            @stephenw10 Your group ACL there only contains 15 IPs. Is that the group that should be allowed access to any site? R: That group of ips should be restricted some content and enable all

                                            What targets do you have set there? R: I have a blacklist where I added the domains to block

                                            What do you have in the Common ACLs? R: I deny the black list that I just created for the group of ips and I allow everything else

                                            Do you actually see traffic from all three subnets in the Squid RealTime logs to show they are all being proxied? R: yes i have access logs

                                            1 Reply Last reply Reply Quote 0
                                            • stephenw10
                                              stephenw10 Netgate Administrator last edited by

                                              Ok, well if that's your blocked clients list do you have group ACLs for each subnet? That;s just one subnet listed there so it would not catch traffic from the other interfaces.

                                              Is that one you have shown working?

                                              Steve

                                              A 1 Reply Last reply Reply Quote 0
                                              • A
                                                ab96 @stephenw10 last edited by

                                                @stephenw10 Ok, well if that's your block clients list do you have group ACLs for each subnet? R: Yes, for each one
                                                Is that one you have shown working? R: Yes it is the one that works well
                                                So how could I do it so that if I accept the block list? :O

                                                1 Reply Last reply Reply Quote 0
                                                • stephenw10
                                                  stephenw10 Netgate Administrator last edited by

                                                  I don't understand the question.

                                                  If traffic from the other subnets is not being filtered then it is probably not matching the group ACLs for those interfaces. Check they are correct.

                                                  Steve

                                                  A 1 Reply Last reply Reply Quote 0
                                                  • A
                                                    ab96 @stephenw10 last edited by

                                                    @stephenw10 my question was because it does not block correctly if I have already configured the squidguard?
                                                    Yes I have already checked and everything corresponds to each group in each list ! :O

                                                    1 Reply Last reply Reply Quote 0
                                                    • stephenw10
                                                      stephenw10 Netgate Administrator last edited by

                                                      Ok can we see shots of that to check?

                                                      It is either not matching the group ACLs or those ACLs are not set to the correct target rules.

                                                      Or it could not be going through Squid at all but you have said that traffic appears in the Squid logs.

                                                      Steve

                                                      A 1 Reply Last reply Reply Quote 0
                                                      • A
                                                        ab96 @stephenw10 last edited by

                                                        @stephenw10 My configuration
                                                        1.JPG 1.1.JPG 1.2.JPG 1.3.JPG 1.4.JPG 1.5.JPG

                                                        2.JPG

                                                        1 Reply Last reply Reply Quote 0
                                                        • stephenw10
                                                          stephenw10 Netgate Administrator last edited by stephenw10

                                                          Ok, which of those is in Blacklist2 that should be being blocked?

                                                          And I assume it is not in conexionpf?

                                                          It should be blocked because 'Do not allow IPs' is checked?

                                                          Steve

                                                          A 1 Reply Last reply Reply Quote 0
                                                          • A
                                                            ab96 @stephenw10 last edited by

                                                            @stephenw10 Ok, which of those is in Blacklist2 that should be being blocked? R = blocked domains for the support area

                                                            And I assume it is not in conexionpf? R = Is the ip of the pfsense to ensure connection to internet

                                                            It should be blocked because 'Do not allow IPs' is checked?

                                                            R = Then I disable this option, I understood that it was so they could not place the ip
                                                            ¨Do not allow IP-Addresses in URL
                                                            To make sure that people do not bypass the URL filter by simply using the IP-Addresses instead of the FQDN you can check this option. This option has no effect on the whitelist¨. in common ACL

                                                            1 Reply Last reply Reply Quote 0
                                                            • stephenw10
                                                              stephenw10 Netgate Administrator last edited by

                                                              That option is to stop people using the IP directly.
                                                              I was asking if you expected that traffic to be blocked because the only thing I see in the log is the pfSense webgui at 172.54.54.254 and mozilla.org. I assume both of those should be passed?

                                                              Incidentally 172.54.54.X is public IP space, it belongs to t-mobile. You should be using a private address there.

                                                              Steve

                                                              A 1 Reply Last reply Reply Quote 0
                                                              • A
                                                                ab96 @stephenw10 last edited by

                                                                @stephenw10 Yes, mark the traffic and the ip is from my proxy jejejje
                                                                guard8.JPG

                                                                1 Reply Last reply Reply Quote 0
                                                                • johnpoz
                                                                  johnpoz LAYER 8 Global Moderator last edited by

                                                                  @stephenw10 said in Configure 3 lan in pfsense:

                                                                  172.54.54.X is public IP space, it belongs to t-mobile.

                                                                  You can not just use public space internally and not expect to run into problems at some point..

                                                                  There is plenty of rfc1918 to use.. 172.16-31.x.x is open for you to use..

                                                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                                                  If you get confused: Listen to the Music Play
                                                                  Please don't Chat/PM me for help, unless mod related
                                                                  2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                                                                  A 1 Reply Last reply Reply Quote 0
                                                                  • stephenw10
                                                                    stephenw10 Netgate Administrator last edited by

                                                                    Ok, which of those URLs should be blocked?
                                                                    It looks like facebook is being denied there. Is that in Blacklist2?

                                                                    Steve

                                                                    A 1 Reply Last reply Reply Quote 0
                                                                    • A
                                                                      ab96 @johnpoz last edited by

                                                                      @johnpoz :o

                                                                      1 Reply Last reply Reply Quote 0
                                                                      • A
                                                                        ab96 @stephenw10 last edited by

                                                                        @stephenw10 Facebook I block it in general in squid and I want to block the blacklist 2

                                                                        1 Reply Last reply Reply Quote 0
                                                                        • stephenw10
                                                                          stephenw10 Netgate Administrator last edited by

                                                                          You blocked facebook where?

                                                                          A 1 Reply Last reply Reply Quote 0
                                                                          • A
                                                                            ab96 @stephenw10 last edited by

                                                                            @stephenw10 In squid to see if it blocks me in a general way

                                                                            1 Reply Last reply Reply Quote 0
                                                                            • stephenw10
                                                                              stephenw10 Netgate Administrator last edited by

                                                                              Yes. I mean where exactly did you make that setting?

                                                                              A 1 Reply Last reply Reply Quote 0
                                                                              • A
                                                                                ab96 @stephenw10 last edited by

                                                                                @stephenw10 Thank you very much already resolved. !! But now I have problems with squid because when I activate it, I do not load the google page and others like yahoo. What could this error be caused? :/

                                                                                1 Reply Last reply Reply Quote 0
                                                                                • stephenw10
                                                                                  stephenw10 Netgate Administrator last edited by

                                                                                  So what was the problem?

                                                                                  What error do you see now when you turn on Squid? In the browser? In the squid log?

                                                                                  Steve

                                                                                  A 1 Reply Last reply Reply Quote 0
                                                                                  • A
                                                                                    ab96 @stephenw10 last edited by

                                                                                    @stephenw10 I already solved it thanks !!! :D

                                                                                    A 1 Reply Last reply Reply Quote 0
                                                                                    • First post
                                                                                      Last post