Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    WAN question

    Scheduled Pinned Locked Moved General pfSense Questions
    12 Posts 2 Posters 22.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      ArtGirl19
      last edited by ArtGirl19

      Hello!

      I have a question - how to block 8.8.8.8 in WAN?
      I've got pfsense 2.4.4-release-p3 (amd64). In LAN rules work, but in WAN - no. I can block 8.8.8.8 for all computers, but not for the router. I mean, Diagnostic - > Ping - a've got ping even two rules.
      rule 1: destination 8.8.8.8, any protocol, ipv4, any sorce, action- block, interface - WAN
      rule 2: source 8.8.8.8, any protocol, ipv4, any destination, action - block, interface - WAN

      LAN re0 - 192.168.1.1
      WAN ue0 - 192.168.0.12
      Gateway 192.168.0.1
      I don't have any "Pass" rule in my WAN Rules list, so it's not possible to be issue because wrong rules.

      Also, i've got installed pfblockerng-devel, OpenVPN (disabled), iperf

      [2.4.4-RELEASE][root@door.localdomain]/root: pfctl -sa
      TRANSLATION RULES:
      no nat proto carp all
      nat-anchor "natearly/*" all
      nat-anchor "natrules/*" all
      nat on ue0 inet from 10.10.10.1 to any port = isakmp -> 192.168.0.12 static-port
      nat on ue0 inet from 127.0.0.0/8 to any port = isakmp -> 192.168.0.12 static-port
      nat on ue0 inet from 192.168.1.0/24 to any port = isakmp -> 192.168.0.12 static-port
      nat on ue0 inet6 from ::1 to any port = isakmp -> (ue0) round-robin static-port
      nat on ue0 inet from 10.10.10.1 to any -> 192.168.0.12 port 1024:65535
      nat on ue0 inet from 127.0.0.0/8 to any -> 192.168.0.12 port 1024:65535
      nat on ue0 inet from 192.168.1.0/24 to any -> 192.168.0.12 port 1024:65535
      nat on ue0 inet6 from ::1 to any -> (ue0) port 1024:65535 round-robin
      no rdr proto carp all
      rdr-anchor "relayd/*" all
      rdr-anchor "tftp-proxy/*" all
      rdr on re0 inet proto tcp from any to ! 192.168.1.1 port = domain -> 127.0.0.1
      rdr on re0 inet proto udp from any to ! 192.168.1.1 port = domain -> 127.0.0.1
      rdr pass on re0 inet proto tcp from any to 10.10.10.1 port = http -> 127.0.0.1 port 8081
      rdr pass on openvpn inet proto tcp from any to 10.10.10.1 port = http -> 127.0.0.1 port 8081
      rdr pass on re0 inet proto tcp from any to 10.10.10.1 port = https -> 127.0.0.1 port 8443
      rdr pass on openvpn inet proto tcp from any to 10.10.10.1 port = https -> 127.0.0.1 port 8443
      rdr-anchor "miniupnpd" all
      
      FILTER RULES:
      scrub on ue0 all fragment reassemble
      scrub on re0 all fragment reassemble
      anchor "relayd/*" all
      anchor "openvpn/*" all
      anchor "ipsec/*" all
      block drop in log quick inet from 169.254.0.0/16 to any label "Block IPv4 link-local"
      block drop in log quick inet from any to 169.254.0.0/16 label "Block IPv4 link-local"
      block drop in log inet all label "Default deny rule IPv4"
      block drop out log inet all label "Default deny rule IPv4"
      block drop in log inet6 all label "Default deny rule IPv6"
      block drop out log inet6 all label "Default deny rule IPv6"
      pass quick inet6 proto ipv6-icmp all icmp6-type unreach keep state
      pass quick inet6 proto ipv6-icmp all icmp6-type toobig keep state
      pass quick inet6 proto ipv6-icmp all icmp6-type neighbrsol keep state
      pass quick inet6 proto ipv6-icmp all icmp6-type neighbradv keep state
      pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type echorep keep state
      pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type routersol keep state
      pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type routeradv keep state
      pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type neighbrsol keep state
      pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type neighbradv keep state
      pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type echorep keep state
      pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type routersol keep state
      pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type routeradv keep state
      pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type neighbrsol keep state
      pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type neighbradv keep state
      pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type echoreq keep state
      pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type routersol keep state
      pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type routeradv keep state
      pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type neighbrsol keep state
      pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type neighbradv keep state
      pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type echoreq keep state
      pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type routersol keep state
      pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type routeradv keep state
      pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type neighbrsol keep state
      pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type neighbradv keep state
      pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type echoreq keep state
      pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type routersol keep state
      pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type routeradv keep state
      pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type neighbrsol keep state
      pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type neighbradv keep state
      pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type echoreq keep state
      pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type routersol keep state
      pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type routeradv keep state
      pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type neighbrsol keep state
      pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type neighbradv keep state
      block drop log quick inet proto tcp from any port = 0 to any label "Block traffic from port 0"
      block drop log quick inet proto udp from any port = 0 to any label "Block traffic from port 0"
      block drop log quick inet proto tcp from any to any port = 0 label "Block traffic to port 0"
      block drop log quick inet proto udp from any to any port = 0 label "Block traffic to port 0"
      block drop log quick inet6 proto tcp from any port = 0 to any label "Block traffic from port 0"
      block drop log quick inet6 proto udp from any port = 0 to any label "Block traffic from port 0"
      block drop log quick inet6 proto tcp from any to any port = 0 label "Block traffic to port 0"
      block drop log quick inet6 proto udp from any to any port = 0 label "Block traffic to port 0"
      block drop log quick from <snort2c> to any label "Block snort2c hosts"
      block drop log quick from any to <snort2c> label "Block snort2c hosts"
      block drop in log quick proto carp from (self) to any
      pass quick proto carp all no state
      block drop in log quick proto tcp from <sshguard> to (self) port = ssh label "sshguard"
      block drop in log quick proto tcp from <sshguard> to (self) port = https label "GUI Lockout"
      block drop in log quick from <virusprot> to any label "virusprot overload table"
      pass in quick on ue0 proto udp from any port = bootps to any port = bootpc keep state label "allow dhcp client out WAN"
      pass out quick on ue0 proto udp from any port = bootpc to any port = bootps keep state label "allow dhcp client out WAN"
      block drop in log quick on ue0 from <bogons> to any label "block bogon IPv4 networks from WAN"
      block drop in log quick on ue0 from <bogonsv6> to any label "block bogon IPv6 networks from WAN"
      block drop in log on ! ue0 inet from 192.168.0.0/24 to any
      block drop in log inet from 192.168.0.12 to any
      block drop in log on ue0 inet6 from fe80::8eae:4cff:fee9:bb0c to any
      block drop in log quick on ue0 inet from 10.0.0.0/8 to any label "Block private networks from WAN block 10/8"
      block drop in log quick on ue0 inet from 127.0.0.0/8 to any label "Block private networks from WAN block 127/8"
      block drop in log quick on ue0 inet from 172.16.0.0/12 to any label "Block private networks from WAN block 172.16/12"
      block drop in log quick on ue0 inet from 192.168.0.0/16 to any label "Block private networks from WAN block 192.168/16"
      block drop in log quick on ue0 inet6 from fc00::/7 to any label "Block ULA networks from WAN block fc00::/7"
      block drop in log on ! re0 inet from 192.168.1.0/24 to any
      block drop in log on ! re0 inet from 10.10.10.1 to any
      block drop in log inet from 192.168.1.1 to any
      block drop in log inet from 10.10.10.1 to any
      block drop in log on re0 inet6 from fe80::1ec1:deff:feb2:bbb9 to any
      pass in quick on re0 inet proto udp from any port = bootpc to 255.255.255.255 port = bootps keep state label "allow access to DHCP server"
      pass in quick on re0 inet proto udp from any port = bootpc to 192.168.1.1 port = bootps keep state label "allow access to DHCP server"
      pass out quick on re0 inet proto udp from 192.168.1.1 port = bootps to any port = bootpc keep state label "allow access to DHCP server"
      pass in on lo0 inet all flags S/SA keep state label "pass IPv4 loopback"
      pass out on lo0 inet all flags S/SA keep state label "pass IPv4 loopback"
      pass in on lo0 inet6 all flags S/SA keep state label "pass IPv6 loopback"
      pass out on lo0 inet6 all flags S/SA keep state label "pass IPv6 loopback"
      pass out inet all flags S/SA keep state allow-opts label "let out anything IPv4 from firewall host itself"
      pass out inet6 all flags S/SA keep state allow-opts label "let out anything IPv6 from firewall host itself"
      pass out route-to (ue0 192.168.0.1) inet from 192.168.0.12 to ! 192.168.0.0/24 flags S/SA keep state allow-opts label "let out anything from firewall host itself"
      pass in quick on re0 proto tcp from any to (re0) port = https flags S/SA keep state label "anti-lockout rule"
      pass in quick on re0 proto tcp from any to (re0) port = http flags S/SA keep state label "anti-lockout rule"
      pass in quick on re0 proto tcp from any to (re0) port = ssh flags S/SA keep state label "anti-lockout rule"
      anchor "userrules/*" all
      block drop in log quick on openvpn inet from <pfB_Africa_v4> to any label "USER_RULE: pfB_Africa_v4 auto rule"
      block drop in log quick on openvpn inet from <pfB_Asia_v4> to any label "USER_RULE: pfB_Asia_v4 auto rule"
      block drop in log quick on openvpn inet6 from <pfB_Asia_v6> to any label "USER_RULE: pfB_Asia_v6 auto rule"
      block drop in log quick on openvpn inet from <pfB_Europe_v4> to any label "USER_RULE: pfB_Europe_v4 auto rule"
      block drop in log quick on openvpn inet from <pfB_SAmerica_v4> to any label "USER_RULE: pfB_SAmerica_v4 auto rule"
      block drop in log quick on openvpn inet from <pfB_DNSBLIP_v4> to any label "USER_RULE: pfB_DNSBLIP_v4 auto rule"
      block drop in log quick on openvpn inet from any to <pfB_Africa_v4> label "USER_RULE: pfB_Africa_v4 auto rule"
      block drop in log quick on openvpn inet from any to <pfB_Asia_v4> label "USER_RULE: pfB_Asia_v4 auto rule"
      block drop in log quick on openvpn inet6 from any to <pfB_Asia_v6> label "USER_RULE: pfB_Asia_v6 auto rule"
      block drop in log quick on openvpn inet from any to <pfB_Europe_v4> label "USER_RULE: pfB_Europe_v4 auto rule"
      block drop in log quick on openvpn inet from any to <pfB_SAmerica_v4> label "USER_RULE: pfB_SAmerica_v4 auto rule"
      block drop in log quick on openvpn inet from any to <pfB_DNSBLIP_v4> label "USER_RULE: pfB_DNSBLIP_v4 auto rule"
      block drop in log quick on ue0 reply-to (ue0 192.168.0.1) inet from <pfB_Africa_v4> to any label "USER_RULE: pfB_Africa_v4 auto rule"
      block drop in log quick on ue0 reply-to (ue0 192.168.0.1) inet from <pfB_Asia_v4> to any label "USER_RULE: pfB_Asia_v4 auto rule"
      block drop in log quick on ue0 inet6 from <pfB_Asia_v6> to any label "USER_RULE: pfB_Asia_v6 auto rule"
      block drop in log quick on ue0 reply-to (ue0 192.168.0.1) inet from <pfB_Europe_v4> to any label "USER_RULE: pfB_Europe_v4 auto rule"
      block drop in log quick on ue0 reply-to (ue0 192.168.0.1) inet from <pfB_SAmerica_v4> to any label "USER_RULE: pfB_SAmerica_v4 auto rule"
      block drop in log quick on ue0 reply-to (ue0 192.168.0.1) inet from <pfB_DNSBLIP_v4> to any label "USER_RULE: pfB_DNSBLIP_v4 auto rule"
      block drop in log quick on re0 inet from <pfB_Africa_v4> to any label "USER_RULE: pfB_Africa_v4 auto rule"
      block drop in log quick on re0 inet from <pfB_Asia_v4> to any label "USER_RULE: pfB_Asia_v4 auto rule"
      block drop in log quick on re0 inet6 from <pfB_Asia_v6> to any label "USER_RULE: pfB_Asia_v6 auto rule"
      block drop in log quick on re0 inet from <pfB_Europe_v4> to any label "USER_RULE: pfB_Europe_v4 auto rule"
      block drop in log quick on re0 inet from <pfB_SAmerica_v4> to any label "USER_RULE: pfB_SAmerica_v4 auto rule"
      block drop in log quick on re0 inet from <pfB_DNSBLIP_v4> to any label "USER_RULE: pfB_DNSBLIP_v4 auto rule"
      block drop in log quick on ue0 reply-to (ue0 192.168.0.1) inet from any to <pfB_Africa_v4> label "USER_RULE: pfB_Africa_v4 auto rule"
      block drop in log quick on ue0 reply-to (ue0 192.168.0.1) inet from any to <pfB_Asia_v4> label "USER_RULE: pfB_Asia_v4 auto rule"
      block drop in log quick on ue0 inet6 from any to <pfB_Asia_v6> label "USER_RULE: pfB_Asia_v6 auto rule"
      block drop in log quick on ue0 reply-to (ue0 192.168.0.1) inet from any to <pfB_Europe_v4> label "USER_RULE: pfB_Europe_v4 auto rule"
      block drop in log quick on ue0 reply-to (ue0 192.168.0.1) inet from any to <pfB_SAmerica_v4> label "USER_RULE: pfB_SAmerica_v4 auto rule"
      block drop in log quick on ue0 reply-to (ue0 192.168.0.1) inet from any to <pfB_DNSBLIP_v4> label "USER_RULE: pfB_DNSBLIP_v4 auto rule"
      block drop in log quick on re0 inet from any to <pfB_Africa_v4> label "USER_RULE: pfB_Africa_v4 auto rule"
      block drop in log quick on re0 inet from any to <pfB_Asia_v4> label "USER_RULE: pfB_Asia_v4 auto rule"
      block drop in log quick on re0 inet6 from any to <pfB_Asia_v6> label "USER_RULE: pfB_Asia_v6 auto rule"
      block drop in log quick on re0 inet from any to <pfB_Europe_v4> label "USER_RULE: pfB_Europe_v4 auto rule"
      block drop in log quick on re0 inet from any to <pfB_SAmerica_v4> label "USER_RULE: pfB_SAmerica_v4 auto rule"
      block drop in log quick on re0 inet from any to <pfB_DNSBLIP_v4> label "USER_RULE: pfB_DNSBLIP_v4 auto rule"
      block drop in quick on ue0 inet6 all label "USER_RULE: Block all IPv6"
      block drop in quick on ue0 reply-to (ue0 192.168.0.1) inet from any to 8.8.8.8 label "USER_RULE"
      block drop in quick on ue0 reply-to (ue0 192.168.0.1) inet from 8.8.8.8 to any label "USER_RULE"
      block drop in quick on ue0 reply-to (ue0 192.168.0.1) inet proto tcp from any to any port = domain label "USER_RULE: Block all non-encrypted DNS"
      block drop in quick on ue0 reply-to (ue0 192.168.0.1) inet proto udp from any to any port = domain label "USER_RULE: Block all non-encrypted DNS"
      block drop in quick on re0 inet proto tcp from any to 192.168.0.0/24 port = telnet label "USER_RULE: Block23"
      block drop in quick on re0 inet proto udp from any to 192.168.0.0/24 port = telnet label "USER_RULE: Block23"
      block drop in quick on re0 inet from 192.168.1.20 to any label "USER_RULE"
      pass in quick on re0 inet from 192.168.1.0/24 to any flags S/SA keep state label "USER_RULE: Default allow LAN to any rule"
      pass in quick on re0 inet from 10.10.10.1 to any flags S/SA keep state label "USER_RULE: Default allow LAN to any rule"
      pass in quick on re0 inet proto tcp from any to 127.0.0.1 port = domain flags S/SA keep state label "USER_RULE: NAT All DNS to pfsense"
      pass in quick on re0 inet proto udp from any to 127.0.0.1 port = domain keep state label "USER_RULE: NAT All DNS to pfsense"
      anchor "tftp-proxy/*" all
      anchor "miniupnpd" all
      No queue in use
      
      STATES:
      ue0 icmp 192.168.0.12:24183 -> 192.168.0.1:24183       0:0
      re0 tcp 208.123.73.199:443 <- 192.168.1.41:50560       ESTABLISHED:ESTABLISHED
      re0 tcp 34.249.72.44:443 <- 192.168.1.41:50562       TIME_WAIT:TIME_WAIT
      ue0 tcp 192.168.0.12:26990 (192.168.1.41:50560) -> 208.123.73.199:443       ESTABLISHED:ESTABLISHED
      re0 tcp 104.27.142.143:443 <- 192.168.1.41:50566       ESTABLISHED:ESTABLISHED
      ue0 tcp 192.168.0.12:44510 (192.168.1.41:50566) -> 104.27.142.143:443       ESTABLISHED:ESTABLISHED
      ue0 tcp 192.168.0.12:1324 (192.168.1.41:50562) -> 34.249.72.44:443       TIME_WAIT:TIME_WAIT
      re0 tcp 74.208.232.36:443 <- 192.168.1.40:42842       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:44825 (192.168.1.40:42842) -> 74.208.232.36:443       FIN_WAIT_2:FIN_WAIT_2
      re0 udp 192.168.1.1:62857 -> 239.255.255.250:1900       SINGLE:NO_TRAFFIC
      ue0 tcp 192.168.0.12:32854 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      re0 tcp 18.203.181.12:443 <- 192.168.1.41:50567       TIME_WAIT:TIME_WAIT
      ue0 tcp 192.168.0.12:16282 (192.168.1.41:50567) -> 18.203.181.12:443       TIME_WAIT:TIME_WAIT
      lo0 tcp 127.0.0.1:953 <- 127.0.0.1:32855       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:953 <- 127.0.0.1:32856       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:32857 -> 127.0.0.1:953       FIN_WAIT_2:FIN_WAIT_2
      re0 tcp 192.168.1.1:22 <- 192.168.1.41:50568       TIME_WAIT:TIME_WAIT
      lo0 tcp 127.0.0.1:32858 -> 127.0.0.1:953       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:953 <- 127.0.0.1:32859       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:953 <- 127.0.0.1:32860       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:32861 -> 127.0.0.1:953       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:32862 -> 127.0.0.1:953       FIN_WAIT_2:FIN_WAIT_2
      re0 tcp 18.203.181.12:443 <- 192.168.1.41:50569       TIME_WAIT:TIME_WAIT
      ue0 tcp 192.168.0.12:3158 (192.168.1.41:50569) -> 18.203.181.12:443       TIME_WAIT:TIME_WAIT
      lo0 tcp 127.0.0.1:57722 -> 127.0.0.1:953       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:18780 -> 127.0.0.1:953       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:24561 -> 127.0.0.1:953       FIN_WAIT_2:FIN_WAIT_2
      re0 tcp 192.168.1.1:22 <- 192.168.1.41:50570       ESTABLISHED:ESTABLISHED
      lo0 tcp 127.0.0.1:953 <- 127.0.0.1:42093       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:25672 -> 127.0.0.1:953       FIN_WAIT_2:FIN_WAIT_2
      lo0 udp 127.0.0.1:37093 -> 127.0.0.1:53       MULTIPLE:SINGLE
      ue0 tcp 192.168.0.12:35566 -> 1.1.1.1:853       TIME_WAIT:TIME_WAIT
      lo0 tcp 127.0.0.1:32855 -> 127.0.0.1:953       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:24940 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:32856 -> 127.0.0.1:953       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:45958 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:25088 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:953 <- 127.0.0.1:32857       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:10416 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:953 <- 127.0.0.1:32858       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:10419 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:32859 -> 127.0.0.1:953       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:10423 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:32860 -> 127.0.0.1:953       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:10425 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:953 <- 127.0.0.1:32861       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:10426 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:953 <- 127.0.0.1:32862       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:10428 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:953 <- 127.0.0.1:57722       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:10431 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:953 <- 127.0.0.1:18780       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:953 <- 127.0.0.1:10443       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:953 <- 127.0.0.1:24561       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:953 <- 127.0.0.1:10444       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:42093 -> 127.0.0.1:953       FIN_WAIT_2:FIN_WAIT_2
      re0 udp 192.168.1.1:53 <- 192.168.1.40:39860       SINGLE:MULTIPLE
      lo0 tcp 127.0.0.1:953 <- 127.0.0.1:25672       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:10455 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      lo0 udp 127.0.0.1:28049 -> 127.0.0.1:53       MULTIPLE:SINGLE
      re0 tcp 74.208.232.61:443 <- 192.168.1.40:34472       FIN_WAIT_2:FIN_WAIT_2
      lo0 udp 127.0.0.1:53 <- 127.0.0.1:28049       SINGLE:MULTIPLE
      ue0 tcp 192.168.0.12:59584 (192.168.1.40:34472) -> 74.208.232.61:443       FIN_WAIT_2:FIN_WAIT_2
      lo0 udp 127.0.0.1:53 <- 127.0.0.1:37093       SINGLE:MULTIPLE
      re0 tcp 74.208.232.61:443 <- 192.168.1.40:34474       ESTABLISHED:ESTABLISHED
      ue0 tcp 192.168.0.12:9073 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:29519 (192.168.1.40:34474) -> 74.208.232.61:443       ESTABLISHED:ESTABLISHED
      ue0 tcp 192.168.0.12:54628 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:10456 -> 127.0.0.1:953       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:10421 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      re0 udp 192.168.1.1:53 <- 192.168.1.41:60245       SINGLE:MULTIPLE
      ue0 tcp 192.168.0.12:10430 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      re0 tcp 52.212.14.221:443 <- 192.168.1.41:50571       ESTABLISHED:ESTABLISHED
      ue0 tcp 192.168.0.12:10436 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:32270 (192.168.1.41:50571) -> 52.212.14.221:443       ESTABLISHED:ESTABLISHED
      ue0 tcp 192.168.0.12:10439 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      lo0 udp 127.0.0.1:16185 -> 127.0.0.1:53       MULTIPLE:SINGLE
      ue0 tcp 192.168.0.12:10442 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      lo0 udp 127.0.0.1:53 <- 127.0.0.1:16185       SINGLE:MULTIPLE
      lo0 tcp 127.0.0.1:10443 -> 127.0.0.1:953       FIN_WAIT_2:FIN_WAIT_2
      lo0 udp 127.0.0.1:53 <- 127.0.0.1:60106       SINGLE:MULTIPLE
      lo0 tcp 127.0.0.1:10444 -> 127.0.0.1:953       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:10461 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:953 <- 127.0.0.1:10456       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:10465 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:10457 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:10469 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      lo0 udp 127.0.0.1:60106 -> 127.0.0.1:53       MULTIPLE:SINGLE
      ue0 tcp 192.168.0.12:10475 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:10459 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      re0 tcp 208.123.73.199:443 <- 192.168.1.41:50572       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:10472 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:10476 -> 127.0.0.1:953       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:7242 (192.168.1.41:50572) -> 208.123.73.199:443       FIN_WAIT_2:FIN_WAIT_2
      lo0 udp 127.0.0.1:47688 -> 127.0.0.1:53       MULTIPLE:SINGLE
      lo0 tcp 127.0.0.1:953 <- 127.0.0.1:10476       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:10477 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      lo0 udp 127.0.0.1:53 <- 127.0.0.1:47688       SINGLE:MULTIPLE
      lo0 tcp 127.0.0.1:953 <- 127.0.0.1:10478       FIN_WAIT_2:FIN_WAIT_2
      lo0 udp 127.0.0.1:27045 -> 127.0.0.1:53       MULTIPLE:SINGLE
      ue0 tcp 192.168.0.12:10483 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      lo0 udp 127.0.0.1:53 <- 127.0.0.1:27045       SINGLE:MULTIPLE
      ue0 tcp 192.168.0.12:10487 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:10478 -> 127.0.0.1:953       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:10488 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      ue0 tcp 192.168.0.12:10482 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      ue0 udp 192.168.0.12:123 -> 83.170.75.28:123       MULTIPLE:SINGLE
      ue0 tcp 192.168.0.12:10486 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:953 <- 127.0.0.1:10489       FIN_WAIT_2:FIN_WAIT_2
      lo0 tcp 127.0.0.1:10489 -> 127.0.0.1:953       FIN_WAIT_2:FIN_WAIT_2
      lo0 udp 127.0.0.1:54796 -> 127.0.0.1:53       MULTIPLE:SINGLE
      lo0 udp 127.0.0.1:58269 -> 127.0.0.1:53       MULTIPLE:SINGLE
      ue0 tcp 192.168.0.12:10492 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      lo0 udp 127.0.0.1:53 <- 127.0.0.1:58269       SINGLE:MULTIPLE
      lo0 udp 127.0.0.1:53 <- 127.0.0.1:54796       SINGLE:MULTIPLE
      ue0 tcp 192.168.0.12:10497 -> 1.1.1.1:853       FIN_WAIT_2:FIN_WAIT_2
      
      INFO:
      Status: Enabled for 0 days 00:02:27           Debug: Urgent
      
      Interface Stats for re0               IPv4             IPv6
        Bytes In                           53580                0
        Bytes Out                         157851              416
        Packets In
          Passed                             474                0
          Blocked                             49                0
        Packets Out
          Passed                             597                5
          Blocked                              0                0
      
      State Table                          Total             Rate
        current entries                      116               
        searches                           18189          123.7/s
        inserts                              248            1.7/s
        removals                             132            0.9/s
      Counters
        match                                339            2.3/s
        bad-offset                             0            0.0/s
        fragment                               0            0.0/s
        short                                  0            0.0/s
        normalize                              0            0.0/s
        memory                                 0            0.0/s
        bad-timestamp                          0            0.0/s
        congestion                             0            0.0/s
        ip-option                              1            0.0/s
        proto-cksum                            0            0.0/s
        state-mismatch                         0            0.0/s
        state-insert                           0            0.0/s
        state-limit                            0            0.0/s
        src-limit                              0            0.0/s
        synproxy                               0            0.0/s
        map-failed                             0            0.0/s
      
      LABEL COUNTERS:
      Block IPv4 link-local 259 0 0 0 0 0 0 0
      Block IPv4 link-local 141 0 0 0 0 0 0 0
      Default deny rule IPv4 141 66 6433 66 6433 0 0 0
      Default deny rule IPv4 258 0 0 0 0 0 0 0
      Default deny rule IPv6 259 0 0 0 0 0 0 0
      Default deny rule IPv6 117 0 0 0 0 0 0 0
      Block traffic from port 0 259 0 0 0 0 0 0 0
      Block traffic from port 0 55 0 0 0 0 0 0 0
      Block traffic to port 0 259 0 0 0 0 0 0 0
      Block traffic to port 0 56 0 0 0 0 0 0 0
      Block traffic from port 0 259 0 0 0 0 0 0 0
      Block traffic from port 0 0 0 0 0 0 0 0 0
      Block traffic to port 0 0 0 0 0 0 0 0 0
      Block traffic to port 0 0 0 0 0 0 0 0 0
      Block snort2c hosts 257 0 0 0 0 0 0 0
      Block snort2c hosts 257 0 0 0 0 0 0 0
      sshguard 260 0 0 0 0 0 0 0
      GUI Lockout 0 0 0 0 0 0 0 0
      virusprot overload table 158 0 0 0 0 0 0 0
      allow dhcp client out WAN 141 0 0 0 0 0 0 0
      allow dhcp client out WAN 120 0 0 0 0 0 0 0
      block bogon IPv4 networks from WAN 156 4 1424 4 1424 0 0 0
      block bogon IPv6 networks from WAN 79 1 356 1 356 0 0 0
      Block private networks from WAN block 10/8 29 0 0 0 0 0 0 0
      Block private networks from WAN block 127/8 29 0 0 0 0 0 0 0
      Block private networks from WAN block 172.16/12 29 0 0 0 0 0 0 0
      Block private networks from WAN block 192.168/16 29 1 32 1 32 0 0 0
      Block ULA networks from WAN block fc00::/7 28 0 0 0 0 0 0 0
      allow access to DHCP server 70 0 0 0 0 0 0 0
      allow access to DHCP server 0 0 0 0 0 0 0 0
      allow access to DHCP server 129 0 0 0 0 0 0 0
      pass IPv4 loopback 254 7168 706687 3596 256070 3572 450617 43
      pass IPv4 loopback 83 0 0 0 0 0 0 0
      pass IPv6 loopback 84 0 0 0 0 0 0 0
      pass IPv6 loopback 42 0 0 0 0 0 0 0
      let out anything IPv4 from firewall host itself 255 7279 759144 3572 450617 3707 308527 45
      let out anything IPv6 from firewall host itself 117 0 0 0 0 0 0 0
      let out anything from firewall host itself 116 1743 535017 731 436324 1012 98693 74
      anti-lockout rule 323 1 48 1 48 0 0 0
      anti-lockout rule 85 1 48 1 48 0 0 0
      anti-lockout rule 85 567 76504 233 16770 334 59734 2
      USER_RULE: pfB_Africa_v4 auto rule 320 0 0 0 0 0 0 0
      USER_RULE: pfB_Asia_v4 auto rule 0 0 0 0 0 0 0 0
      USER_RULE: pfB_Asia_v6 auto rule 0 0 0 0 0 0 0 0
      USER_RULE: pfB_Europe_v4 auto rule 0 0 0 0 0 0 0 0
      USER_RULE: pfB_SAmerica_v4 auto rule 0 0 0 0 0 0 0 0
      USER_RULE: pfB_DNSBLIP_v4 auto rule 0 0 0 0 0 0 0 0
      USER_RULE: pfB_Africa_v4 auto rule 0 0 0 0 0 0 0 0
      USER_RULE: pfB_Asia_v4 auto rule 0 0 0 0 0 0 0 0
      USER_RULE: pfB_Asia_v6 auto rule 0 0 0 0 0 0 0 0
      USER_RULE: pfB_Europe_v4 auto rule 0 0 0 0 0 0 0 0
      USER_RULE: pfB_SAmerica_v4 auto rule 0 0 0 0 0 0 0 0
      USER_RULE: pfB_DNSBLIP_v4 auto rule 0 0 0 0 0 0 0 0
      USER_RULE: pfB_Africa_v4 auto rule 320 0 0 0 0 0 0 0
      USER_RULE: pfB_Asia_v4 auto rule 28 2 88 2 88 0 0 0
      USER_RULE: pfB_Asia_v6 auto rule 26 0 0 0 0 0 0 0
      USER_RULE: pfB_Europe_v4 auto rule 26 2 88 2 88 0 0 0
      USER_RULE: pfB_SAmerica_v4 auto rule 24 0 0 0 0 0 0 0
      USER_RULE: pfB_DNSBLIP_v4 auto rule 24 0 0 0 0 0 0 0
      USER_RULE: pfB_Africa_v4 auto rule 193 0 0 0 0 0 0 0
      USER_RULE: pfB_Asia_v4 auto rule 76 0 0 0 0 0 0 0
      USER_RULE: pfB_Asia_v6 auto rule 76 0 0 0 0 0 0 0
      USER_RULE: pfB_Europe_v4 auto rule 76 0 0 0 0 0 0 0
      USER_RULE: pfB_SAmerica_v4 auto rule 76 0 0 0 0 0 0 0
      USER_RULE: pfB_DNSBLIP_v4 auto rule 76 0 0 0 0 0 0 0
      USER_RULE: pfB_Africa_v4 auto rule 190 0 0 0 0 0 0 0
      USER_RULE: pfB_Asia_v4 auto rule 24 0 0 0 0 0 0 0
      USER_RULE: pfB_Asia_v6 auto rule 24 0 0 0 0 0 0 0
      USER_RULE: pfB_Europe_v4 auto rule 24 0 0 0 0 0 0 0
      USER_RULE: pfB_SAmerica_v4 auto rule 24 0 0 0 0 0 0 0
      USER_RULE: pfB_DNSBLIP_v4 auto rule 24 0 0 0 0 0 0 0
      USER_RULE: pfB_Africa_v4 auto rule 189 0 0 0 0 0 0 0
      USER_RULE: pfB_Asia_v4 auto rule 76 0 0 0 0 0 0 0
      USER_RULE: pfB_Asia_v6 auto rule 76 0 0 0 0 0 0 0
      USER_RULE: pfB_Europe_v4 auto rule 76 0 0 0 0 0 0 0
      USER_RULE: pfB_SAmerica_v4 auto rule 76 0 0 0 0 0 0 0
      USER_RULE: pfB_DNSBLIP_v4 auto rule 76 0 0 0 0 0 0 0
      USER_RULE: Block all IPv6 189 0 0 0 0 0 0 0
      USER_RULE 24 0 0 0 0 0 0 0
      USER_RULE 24 0 0 0 0 0 0 0
      USER_RULE: Block all non-encrypted DNS 24 0 0 0 0 0 0 0
      USER_RULE: Block all non-encrypted DNS 4 0 0 0 0 0 0 0
      USER_RULE: Block23 189 0 0 0 0 0 0 0
      USER_RULE: Block23 30 0 0 0 0 0 0 0
      USER_RULE 76 0 0 0 0 0 0 0
      USER_RULE: Default allow LAN to any rule 76 262 59533 154 24328 108 35205 22
      USER_RULE: Default allow LAN to any rule 54 27 7075 19 3131 8 3944 0
      USER_RULE: NAT All DNS to pfsense 49 0 0 0 0 0 0 0
      USER_RULE: NAT All DNS to pfsense 3 0 0 0 0 0 0 0
      
      TIMEOUTS:
      tcp.first                   120s
      tcp.opening                  30s
      tcp.established           86400s
      tcp.closing                 900s
      tcp.finwait                  45s
      tcp.closed                   90s
      tcp.tsdiff                   30s
      udp.first                    60s
      udp.single                   30s
      udp.multiple                 60s
      icmp.first                   20s
      icmp.error                   10s
      other.first                  60s
      other.single                 30s
      other.multiple               60s
      frag                         30s
      interval                     10s
      adaptive.start           115200 states
      adaptive.end             230400 states
      src.track                     0s
      
      LIMITS:
      states        hard limit   192000
      src-nodes     hard limit   192000
      frags         hard limit     5000
      table-entries hard limit   400000
      
      TABLES:
      bogons
      bogonsv6
      pfB_Africa_v4
      pfB_Asia_v4
      pfB_Asia_v6
      pfB_DNSBLIP_v4
      pfB_Europe_v4
      pfB_SAmerica_v4
      snort2c
      sshguard
      virusprot
      
      OS FINGERPRINTS:
      762 fingerprints loaded
      [2.4.4-RELEASE][root@door.localdomain]/root: 
      

      What is this

      block drop in quick on ue0 reply-to (ue0 192.168.0.1) inet from any to 8.8.8.8 label "USER_RULE"
      block drop in quick on ue0 reply-to (ue0 192.168.0.1) inet from 8.8.8.8 to any label "USER_RULE"
      

      ue0 must be 192.168.0.12 not 192.168.0.1

      In fact, 192.168.0.1 is my Sky Hub router/modem.

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by johnpoz

        @ArtGirl19 said in WAN question:

        I have a question - how to block 8.8.8.8 in WAN?

        Huh? 8.8.8.8 would never be creating traffic to you.. And even if it did the default deny rule would just drop the traffic.. Unless you had a port forward.

        If you want stop your client from talking to an IP, you would put that rule on your LAN, not your wan.. Once you let a client talk to something, then the state would allow the answer.

        If you want to show your rules its just easier to post a screen shot, then its a 2 second view on our part to understand what you have done.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • A
          ArtGirl19
          last edited by ArtGirl19

          alt text
          That's my rules. I don't want to stop the clients only. I want to stop clients and the router as well. And 8.8.8.8 is just example. In fact, the rules just dont work on WAN. I've got lot of addresses blocked in pfblocker, but there are not. Like 2.21.98.84 (In Africa ipv4 list) - blocked for clients, but is not for the router (pfblocker add rules in both interfaces with action "block"). I've got ping and i'm sure they have to me as well.

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by johnpoz

            Not sure what you think rules on the WAN are going to do??

            Out of the box ALL unsolicited traffic to your wan IP is dropped.. You do not have to do ANYTHING for this to happen..

            I can not even tell what interface those rules are on.. Just attach the images here.. How hard is it to show your rules?

            wanrules.png

            and the router as well

            You mean pfsense? You can not stop pfsense from talking to what it needs to talk to.. The only thing its going to talk to is checking for updates..

            If you want to stop client from talking to ip 1.2.3.4 then those would go on your LAN.. Rules on your wan would only stop IP 4.5.6.7 from accessing some port forward you had open. If the block was above where your port forward rule was.

            Since you have Zero port forwards - every single one of those rules on your WAN are 100 percent POINTLESS!!!

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 1
            • A
              ArtGirl19
              last edited by ArtGirl19

              one.png
              two.png

              3.png
              That's after states restart and computer restart.

              "Since you have Zero port forwards - every single one of those rules on your WAN are 100 percent POINTLESS!!"

              So, hot to fix it? What port to forward to where?

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by johnpoz

                Not sure what your not understanding.. What are you wanting to stop.. Your clients from talking to Asia? Then those rules would go on your LAN, not your wan.

                And again you can not stop pfsense from talking to the internet.. There are 2 rules that not shown in the gui

                pass out inet all flags S/SA keep state allow-opts label "let out anything IPv4 from firewall host itself"
                pass out inet6 all flags S/SA keep state allow-opts label "let out anything IPv6 from firewall host itself"
                

                If users could stop firewall from talking to the internet - the forum would be flooded with users breaking their shit! ;) hehehe

                If you want to stop a client on your lan from talking to 8.8.8.8 then put that on your LAN..

                block.png

                Rules are evaluated as traffic enters interface, top down, first rule to trigger wins, no other rules are evaluated.

                https://docs.netgate.com/pfsense/en/latest/firewall/firewall-rule-processing-order.html

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • A
                  ArtGirl19
                  last edited by

                  @johnpoz said in WAN question:

                  And again you can not stop pfsense from talking to the internet..

                  Tha's what i can not understand. I'm not able to control the traffic of my computer? Come on.. Come on.. Cannot be true... It's very simple. I want to block all my computers to the IP list. Not desktops, phone only - all of them including the router.

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by johnpoz

                    And I showed you the rules.. Pfsense is the your ROUTER!! It is your firewall!! Traffic "IT" creates you can not stop..

                    "IT" needs to create the nats for your client behind it to talk to 1.2.3.4 on the internet.. If the rules was not how would it do that, etc..

                    You can stop devices behind pfsense from doing whatever you want, but you can not block pfsense itself from talking to the internet.. It doesn't talk to the internet.. It ONLY checks for updates..

                    I showed you exactly how to block any computer on your network from talking to the internet - its simple rules you put on the LAN interface of pfsense.. Since this is were the traffic enters pfsense to "get" to the internet.. If you want to block something this is where it is done.. NOT on the internet side "wan"

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • A
                      ArtGirl19
                      last edited by ArtGirl19

                      Thank you for your answers! It's not just updates, but also NTP, packet downloads etc. . What's the idea of WAN rules? And, if i'm using encrypted DNS, how to block anything to not going outside WAN on port 53? Or... i wan't to block port 123 on pfsense?

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by johnpoz

                        Its only going to check ntp, if you enabled it.

                        Wan rules are to "allow" stuff ;) out of the box all interfaces DENY all unsolicited traffic.. You have to create rules to allow traffic. If you forward something, say you were running a web server on IP behind pfsense 192.168.1.100 for example, and you wanted allow all but IP 1.2.3.4 from talking to this server behind pfsense. You would create a port forward, and above that you would put a block for of 1.2.3.4.. Rules evaluated top down, first rule to trigger wins! Read the link I provided on order of firewall rules evaluation.

                        Out of the box all inbound to the wan is denied, since there are no rules.

                        If you want to block stuff behind pfsense from talking outbound on 53, then put the rule AGAIN on your LAN.. this is where clients behind pfsense are stopped from doing something past pfsense.

                        If you dont want clients to talk ntp, then block it again on the LAN.. If you don't want pfsense to set it time via ntp, then disable ntp.. Remove the ntp servers listed, by default it talks to pfsense pool.

                        Pretty shitty of firewall logs and any logs that time is not correct ;) If you don't want it to talk to internet for time - setup a local ntp server or use pps, etc. etc.

                        If users could stop pfsense from talking outbound, I know for a freaking fact the forum would be flooded - pfsense can not get an IP, client can not talk to the internet, etc. etc.. Because they didn't think it through and stop pfsense from creating outbound connection, you know like asking for an IP address from dhcp server for its wan.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • A
                          ArtGirl19
                          last edited by

                          Last question. How to protect all my network against port scans, ping etc. to .. let's say couple IPs? If i lake to be incognito? Like 100% incognito. No ping answers, nothing.

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by johnpoz

                            That is out of the box how it pfsense is - nothing to do for that.. Not sure what part your not understanding about the default deny.. All unsolicited traffic inbound to pfsense wan is just dropped.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 1
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.