Default deny rule IPv4
-
Hi All,
Can I disable the Default deny rule IPv4? It block my Lan1 to Lan2 asymmetric route traffic.
@9(1000106643) block drop in log inet all label "Default deny rule IPv4"
[ Evaluations: 1283 Packets: 76 Bytes: 4080 States: 0 ]If I use the command "pfctl -d" to disable the filter function, Server A to Server B is working properly.
Thanks,
Tom -
Just place a rule that passes all ahead of it. Rules are done in order, with first match.
-
@tomli said in Default deny rule IPv4:
Lan1 to Lan2 asymmetric route traffic.
Why and the F would your traffic between lans be asymmetrical - if it is, that is what you should be fixing.
-
Hi all,
Just place a rule that passes all ahead of it. Rules are done in order, with first match.
How can i set the user rule has the high priority then the default deny rule ipv4 rule set?
Thanks,
Tom -
Your not going to pass asymmetrical traffic.. Pfsense needs to see the syn to create the state..
What the user needs to do is draw up their network, post it here - why would anyone on purpose want their network to be asymmetrical, and then do some hack on their firewall to pass said traffic.
So we can discuss how to correctly set it up so its NOT asymmetrical
2 possible work a rounds is source natting or host routing.. But the best solution is just to not do it in the first place.
-
@tomli said in Default deny rule IPv4:
How can i set the user rule has the high priority then the default deny rule ipv4 rule set?
As I mentioned, those rules are processed in order and stop at the first match. Putting it anywhere in the list will put it ahead of the default deny will put it first. Firewalls normally start with just a deny all rule and you enable what you want by creating rules to allow it. If you really want allow all, just put it where you want it in the list.
-
That will only work if the blocked traffic is a SYN. That is pretty much never the case where asymmetry is involved.
I'm with @johnpoz . Fix the asymmetry.
If you really don't want to for some inexplicable reason, your best bet is checking the static route filtering box in System > Advanced, Firewall & NAT.
-
Yeah, the real solution here is to remove the asymmetric route.
However you can pass asymmetric traffic it just requires firewall rules with additional options:
https://docs.netgate.com/pfsense/en/latest/firewall/troubleshooting-blocked-log-entries-due-to-asymmetric-routing.html#manual-fixSteve
-
Bad idea to show users work a rounds that might be ok in a tech pinch where production needs to be up NOW, and you will actually fix it asap.. But give a user a button to press that allows what they are doing to function.. Be it a mess or not - and it will most likely stay that way.
-
Yeah, I hear you.
To be clear, if I wasn't, removing asymmetry should be the first option here. Sloppy state work-arounds are for when you have no other option.
Steve
-
There is always another option. :)
