How do I whitelist the firewall itself from firewall rules?

skilledinept

Whenever I create rules blocking everything on the main network towards a certain destination the firewall itself loses access to it to. The same rule on other interfaces seems to be OK no matter how generic the source (i.e; ANY to something) of the rule.

I figured the firewall must lie within the main interface, seems logical. To make a whitelisting rule I don't know how go proceed though, should I use the IP address for that interface, a loopback address, the whole loopback range? In the states I see that it connects from the external IP address but cannot locate none of the addresses I just mentioned. I can't make a rule for that IP address because it's dynamic, I'm not sure if it'd work with an alias.

I had this figured out already but it was a long time ago, a mix of recent changes with my ISP and RADIUS needed me to start the ruleset from scratch. :/

Thanks !

mikeisfly

Add a rule to allow the firewall's interface and put it before your block rule.

skilledinept

Hey thanks, that'd be the internal main interface, right? Something like 172.18.22.1?

Thanks for your help!

johnpoz

@skilledinept said in How do I whitelist the firewall itself from firewall rules?:

Whenever I create rules blocking everything on the main network towards a certain destination the firewall itself loses access to it to.

That is not really possible - there are hidden rules that allow the firewall to do whatever it needs to do..

Could you please post your rules and and what you believe the firewall can not talk to..

skilledinept

@johnpoz It's DNS, all DNS.

I will double check though, I thought so too because I remember reading on the static routes help that the firewall knows the routes it's connected to so no need for static routes for directly attached ones--it makes sense. I have outbound floating rules though, thought maybe those were involved. A clear confirmation, like your answers is hugely helpful though so I know what to focus on. I'll check back, I'm on an Uber on my way there.

johnpoz

Once you get there - post details.. About ready to chill and watch some tv with the wife.. But here to help..

If pfsense is directly connected to a network, there is no need for any routing for it to talk to anything on a network its connected too.. But if dns related - if unbound is say not allowed to use interface X for outbound queries, that could be a problem and not related to a "firewall" rule.