Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Policy based rule blocks Rule below

    Scheduled Pinned Locked Moved Firewalling
    6 Posts 3 Posters 501 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Q
      quasides
      last edited by

      Hello everyone

      I have a wierd issue or maybe i missunderstand here something.

      i have 2 rules on my wan2.

      #1
      IPv4 UDP / Source * / Port * /Destination 127.0.0.1 / Port 1200 /Gateway Failover/ queue none
      #2
      IPv4 UDP / Source * / Port * /Destination 127.0.0.1 / Port 1200 /Gateway */ queue none

      Rule#2 was just added to test nat functionality.
      Idea of rule 1 is that it will only allow traffic when failover is active. (This works, Failover works all fine)
      However when i tried to test something related and i needed to open the port i added rule2

      Expected : traffic does not match rule#1 so rule#2 will be active
      Reality: connection on port 1200 is not possible (yet could not find a firewall logentry either)
      however when i move rule#2 above #1 connection works again.

      if i delete #2, and test failover (set WAN1 to down) that rule works too

      do i miss something here?

      1 Reply Last reply Reply Quote 0
      • kiokomanK
        kiokoman LAYER 8
        last edited by kiokoman

        yes, well i don't understand why 127.0.0.1 but in any case rule 1 always match so rule 2 never apply
        the firewall does not care if "Gateway Failover" is up or down. rules 1 always apply
        you don't need to select the gateway on your rules if you want to use wan2 as failover, you just give priority to the gateway, if gateway 1 is up pfsense will always use that gateway to go out, if gateway 1 go down pfsense will use automatically gateway 2 to go out. when gateway 1 return up, all new states will automatically be created back to gateway 1

        ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
        Please do not use chat/PM to ask for help
        we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
        Don't forget to Upvote with the 👍 button for any post you find to be helpful.

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          How wold dest 127.0.0.1 ever match?

          When would the interface see traffic with a dest of 127.0.0.1?

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • kiokomanK
            kiokoman LAYER 8
            last edited by kiokoman

            i was in the assumption that he want to hide the real ip 🤔

            ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
            Please do not use chat/PM to ask for help
            we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
            Don't forget to Upvote with the 👍 button for any post you find to be helpful.

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by

              Maybe - then use something that is obvious 1.2.3.4 for example.. And make a statement to the fact that no that is not real IP changed for privacy reasons, etc..

              Can only go with what is presented, can not read minds.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              Q 1 Reply Last reply Reply Quote 0
              • Q
                quasides @johnpoz
                last edited by

                @johnpoz no 127.0.0.1 is correct

                its for openvpn.
                wan1 has nat to 127.0.0.1:1200
                wan2 has nat to 127.0.0.1:1200

                openvpn is bound to localhost.

                now the gateway is important to be set on failover - why?
                well i have a lot of routers incomming that are not pfsense, they run openvpn 2.4 but in a very minimalistic way.
                so the best failoverconfiguration so far is

                Clientside: has 2 remote entrys and short reconnect timeouts. remote 1 goes to wan1 on the pfsense, remote 2 to wan2

                Now the trick here is that if wan1 goes down, firewallrule with set to gateway will deny any access to openvpn via wan1
                same time cut of any leftovers - thats important in cases where the failover is triggered for like packetloss. in that case clients often stay connected, on a not really useable line.

                this way they are forced to reconnect. now since the firewall now blocks wan1, they will retry to wan2.
                wan2 is now active and let them in.

                however theres no way to bring openvpn back to wan1 once its ok again. not even an eeasy way to determine which client is connect to which wan. This is because i need to iroute my clients subnets into my own. because of this i cannot use a second instance of openvpn (cannot route back without ospf, clients dont support ospf). so i need to use once instance.

                to solve this i have the gateway directive also on wan2. once failover falls back to wan1, connections will be cut off imidiatly and access to wan2 is blocked. clients now reconnect in their server list and will land eventually back on wan1 and reconnect

                this works 100% and is so far the best failover for external clients with irouting.


                Now back to topic, ahh i missunderstodd the gateway option, well need sleep.
                well for my use case it doenst matter as it works as described, i was just curious why my test rule doenst apply, i wont need that one anyway.

                i assumed he wont match the packet if gateway does not match. well looks like it does match, but my desired outcome is the same, by intentionally misconfigure the gateway :)
                well... if it works...it aint stupid :)

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post
                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.