Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    How do I whitelist the firewall itself from firewall rules?

    Firewalling
    3
    6
    383
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • skilledinept
      skilledinept last edited by

      Whenever I create rules blocking everything on the main network towards a certain destination the firewall itself loses access to it to. The same rule on other interfaces seems to be OK no matter how generic the source (i.e; ANY to something) of the rule.

      I figured the firewall must lie within the main interface, seems logical. To make a whitelisting rule I don't know how go proceed though, should I use the IP address for that interface, a loopback address, the whole loopback range? In the states I see that it connects from the external IP address but cannot locate none of the addresses I just mentioned. I can't make a rule for that IP address because it's dynamic, I'm not sure if it'd work with an alias.

      I had this figured out already but it was a long time ago, a mix of recent changes with my ISP and RADIUS needed me to start the ruleset from scratch. :/

      Thanks !

      1 Reply Last reply Reply Quote 0
      • M
        mikeisfly last edited by

        Add a rule to allow the firewall's interface and put it before your block rule.

        1 Reply Last reply Reply Quote 0
        • skilledinept
          skilledinept last edited by

          Hey thanks, that'd be the internal main interface, right? Something like 172.18.22.1?

          Thanks for your help!

          1 Reply Last reply Reply Quote 0
          • johnpoz
            johnpoz LAYER 8 Global Moderator last edited by

            @skilledinept said in How do I whitelist the firewall itself from firewall rules?:

            Whenever I create rules blocking everything on the main network towards a certain destination the firewall itself loses access to it to.

            That is not really possible - there are hidden rules that allow the firewall to do whatever it needs to do..

            Could you please post your rules and and what you believe the firewall can not talk to..

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

            skilledinept 1 Reply Last reply Reply Quote 0
            • skilledinept
              skilledinept @johnpoz last edited by

              @johnpoz It's DNS, all DNS.

              I will double check though, I thought so too because I remember reading on the static routes help that the firewall knows the routes it's connected to so no need for static routes for directly attached ones--it makes sense. I have outbound floating rules though, thought maybe those were involved. A clear confirmation, like your answers is hugely helpful though so I know what to focus on. I'll check back, I'm on an Uber on my way there.

              1 Reply Last reply Reply Quote 0
              • johnpoz
                johnpoz LAYER 8 Global Moderator last edited by johnpoz

                Once you get there - post details.. About ready to chill and watch some tv with the wife.. But here to help..

                If pfsense is directly connected to a network, there is no need for any routing for it to talk to anything on a network its connected too.. But if dns related - if unbound is say not allowed to use interface X for outbound queries, that could be a problem and not related to a "firewall" rule.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post