Preventing access to secondary firewall
-
@kayavila said in Preventing access to secondary firewall:
That's not quite what I'm trying to do. In the above rule, I'm trying to give the host in the "test" alias access to all of the servers on the LAN net, without giving it access to the secondary (or primary) firewall address. But as is, the rules prevent access to the primary but allow access to the secondary.
I would check that again. This Firewall will do the same thing on the secondary when that rule is synced from the primary. It will mean all of the secondary's interface addresses there.
If it makes a difference, in my setup traffic would be coming in through a VIP to the primary firewall and then routed over to the secondary firewall.
If it is being subjected to Outbound NAT, then that is the source address you will have to block from on the secondary.
-
@Derelict said in Preventing access to secondary firewall:
I would check that again. This Firewall will do the same thing on the secondary when that rule is synced from the primary. It will mean all of the secondary's interface addresses there.
I'm certain Anti-Lockout is disabled on both boxes.
We're hypothesizing that this is related to state syncing, which is turned on in our pairs. This Firewall corresponds to the secondary's IP address(es) in the rules on the secondary, but in this case, the rules on the secondary are never evaluated. The primary has already allowed the traffic through and synchronized the state. The secondary sees the traffic as an existing connection and permits it, without ever checking it against the rules.
If I turn off "Synchronize states" under System -> High Availability Sync, I no longer see the traffic being permitted to the secondary. The secondary's rules are evaluated and the traffic is blocked.
@Derelict said in Preventing access to secondary firewall:
If it is being subjected to Outbound NAT, then that is the source address you will have to block from on the secondary.
True, but there's no Outbound NAT in our setups.
-
Why are you not connecting directly to the secondary then? Why are you going through the primary? That usually creates an asymmetric routing scenario at best.
-
I'm trying to prevent other hosts from being able to access the secondary's interface. So this is about traffic that I would like to be prevented, but doesn't seem to work the way I would have assumed it should work (before we started digging into it).
Likely other people are assuming This Firewall works the way we originally did, and believed their secondary firewalls had protections in place to limit management access. It doesn't appear to work that way. This should probably be called out in the documentation.
I'm wondering if this is something that's generally known and people just create an alias with all of the firewalls' IP addresses and VIPs and block that rather than using This Firewall, or if there's something we're missing.
-
@Derelict said in Preventing access to secondary firewall:
Why are you not connecting directly to the secondary then? Why are you going through the primary? That usually creates an asymmetric routing scenario at best.
Just to clarify and answer your question, we route all traffic through the VIP on the WAN interface of the clusters, so that we can have fast failover. So traffic to the LAN interface of the secondary would be routed through the VIP (currently living on the WAN interface of the primary) out through the primary's LAN interface to the secondary's LAN interface.
-
Right. A scenario similar to this:
https://docs.netgate.com/pfsense/en/latest/highavailability/troubleshooting-vpn-connectivity-to-a-high-availability-secondary-node.html?highlight=access%20secondary
Outbound NAT is the solution there too.
-
@Derelict No, I don't think so. That link describes a situation where "one can communicate with the master but the backup node is unreachable."
We have connectivity just fine. Connectivity isn't the issue. The issue is the rules not blocking the traffic.
-
You need to explain your situation exactly. In a situation where the client is directly on the LAN side of the HA cluster, the rules work fine. How is your client reaching the LAN side of the firewalls?
-
I'm not sure how else to explain the situation aside from the first screenshot and my walkthrough explaining how the traffic is routed, but I'll try. The above screenshot is a simplified example, but one that we've tested and shows the behavior.
In a nutshell, I would like the addresses in test to be blocked from accessing the secondary firewall's LAN address, while being able to access other servers in that subnet. The rules certainly block access to the primary firewall's LAN address. However, they permit traffic coming from test to access ssh on the secondary firewall's LAN address.
In this setup, primary and the secondary are set up in a cluster, with traffic being routed through a VIP that's currently active on the primary firewall. The firewalls are set up to synchronize state.
This is only an issue when state synchronization is turned on.
-
Where do the addresses in test come from? A tunnel? Another directly connected interface? A router on the LAN?
-
@dotdash said in Preventing access to secondary firewall:
Where do the addresses in test come from? A tunnel? Another directly connected interface? A router on the LAN?
A subnet outside of the firewall environment, not directly related to the firewall in any way. They would be routed through but not originate from a router on the LAN. In this particular case, I used a wireless address from my laptop to test. It was routed through our internal environment to the pfSense pair's uplink router and ultimately to the pfSense itself. There's no VPN or tunnel involved.
However, test could represent any IP address external to the environment. The goal is to allow external entities access to the LAN subnet while still protecting both firewalls' LAN interfaces.
These are not my actual IP addresses, but for an equivalent example, say 10.0.0.0/24 is the subnet between the pfSense pair and their upstream router. 10.0.0.1 is the upstream gateway router. The primary firewall's address is 10.0.0.101, the secondary is 10.0.0.102, and the VIP address is 10.0.0.100. On the LAN subnet, the primary firewall is 172.168.0.2, the secondary is 172.168.0.3, and the VIP on that subnet is 172.168.0.1. The IP address in test could be 192.168.0.1. Currently (with the rules in the screenshot above) it can access 172.168.0.3.
-
The rule blocking the traffic will have to be on the secondary's LAN interface because that is where the traffic is arriving on the secondary.
Or you will have to create a rule on WAN that specifically blocks traffic to the secondary's LAN interface address. This Firewall (self) on the primary will not include that address because it's not on This Firewall. Having the rule on secondary's WAN will not do any good (unless that firewall holds the CARP VIP) becaue the traffic is not arriving on the Secondary's WAN, but on its LAN via the primary.
-
Yes, that's an excellent point about the WAN address. I forgot to mention that there's a rule there that should be blocking access. I'll include a screenshot below.
Here's a diagram that might help. Traffic is taking the red dotted path. First it encounters the LAN ruleset on the primary at point #1 (screenshot below), then it should encounter the WAN ruleset at point #2 on the secondary.
When state synchronization is turned on, the rule at #2 doesn't appear to do anything, and the traffic from test to the secondary's LAN interface is allowed, presumably because it matches an existing state. If I turn state synchronization off, it begins blocking it.
Rules from the WAN interface (step #1):
Rules from the LAN interface (step #2):
-
@kayavila said in Preventing access to secondary firewall:
First it encounters the LAN ruleset on the primary at point #1 (screenshot below), then it should encounter the WAN ruleset at point #2 on the secondary.
Actually you have that backwards. It encounters the primary's WAN rule then the secondary's LAN rule.
If you think it is matching a state, connect and see what the state table says?
In general, what you are doing will not work because the reply traffic from the secondary will take the default route back to the test host and you will have asymmetric states which will fail, so you must have something else in play here. Unless you perform outbound NAT out the .2 interface on the primary.
If you want traffic to be blocked, as I have said before, you need to block it with a WAN rule blocking access to 172.168.0.3. (172.168?)
-
@Derelict My diagram is correct, I just typo'ed the interface names in the writeup. Yes, it hits #1 first, the WAN interface, and then #2 on the LAN second.
It works just fine with the asymmetric routes and no outbound NAT, however. The return traffic still makes it back to test.
I realize that adding a firewall rule on the WAN interface will work. That's what my initial question was about... do people just create an alias and include all the firewall IPs (from both firewalls) and VIPs and block that explicitly, or is there a better way to do this? Since obviously this situation could happen with each one of the interfaces...
-
Most people do not pass traffic in WAN to the inside network so it is not a problem.
You will have to look at the states to see why the traffic is not being blocked on the LAN interface of the secondary. Something tells me traffic is not flowing like you think it is.
-
This is a toy example meant to illustrate the problem. You've said both that a rule would be needed on the WAN to the secondary firewall's LAN interface, and also that you think the rules on the LAN interface should block it. I can't tell if you're saying this is expected behavior for it to not be blocked, or not.
I agree that most people are probably not allowing full traffic from the inside to their outside. However, the reverse is certainly common (allowing all from the inside to the outside) - some environments may have an allow all out to the outside. In that situation, even the block to This Firewall will not stop the inside clients from reaching the outside interface of the secondary firewall.
It becomes even more difficult in situations with multiple inside interfaces... hence me wondering about whether I really need to create an alias all of both firewall's IP addresses, and block that instead. I don't think most people are going to work through that and realize their secondary firewalls' interfaces are unprotected.
If you set it up in a lab, with NAT turned off and state syncing turned on, I think you'll see that it behaves the way I'm describing it.
-
I am not going to set it up because I am certain that I will not see it as you are.
NAT has absolutely nothing to do with hosts on inside interfaces accessing the firewall's outside interface address.
Then you are not misunderstanding something very basic or have something else misconfigured. A synced rule blocking access to This Firewall (self) will absolutely block traffic to the primary on the primary and the secondary on the secondary.
Please send me the contents of /tmp/rules.debug from both nodes in chat and explain exactly what you think should be being blocked in the real world situation that is not being blocked. Please be as specific as possible. Source and destination addresses, etc.
Thanks.
-
I cannot send you our production rules, but we've tested and confirmed this behavior on three different clusters. The best I could do is set up a lab, confirm the behavior, and send you that config. If time permits, we will do that.
I mention NAT only to make it clear that NAT is not involved in our scenarios, since you've asked me about it several times.
@kayavila said in Preventing access to secondary firewall:
I can't tell if you're saying this is expected behavior for it to not be blocked, or not.
Would you please confirm if you think the traffic should be allowed or not without explicitly blocking the secondary IP addresses?
-
This firewall rules sync from the primary to the secondary. It covers the interface addresses on the firewall upon which the rule is active.
