Need help with Stateless rule



  • Re: Pfsense in Stateless mode

    Hi,

    I'm trying to create some rules with no state enable (just for learning, I know that Pfsense is a statefull firewall), I'm following what @jimp said in the link above, but I'm stuck.

    Could someone point out what I'm doing wrong?

    Just to recall what @jimp said:

    In LAN-Source any to destination LAN segment(x.x.x.x/23)

    This is backwards. Traffic inbound on LAN is from your LAN segment, not to.

    Out WAN-Source Public subnet (y.y.y.y/z) to destination any
    

    That is OK

    In WAN-Source any to destination Public Subnet (y.y.y.y/z)
    

    That is OK

    Out LAN- Source LAN Segment (x.x.x.x/23) to Destination Any
    

    This is backward. Traffic exiting the LAN is going to your LAN.

    I did this:

    pass in  quick on mvneta1 inet proto tcp from 192.168.10.0/24 to any flags S/SA no state label "USER_RULE: LAN - TCP in"
    pass out quick on mvneta1 inet proto tcp from any to 192.168.10.0/24 flags S/SA no state label "USER_RULE: LAN - TCP out"
    
    pass in  quick on mvneta2 reply-to (mvneta2 192.168.100.1) inet proto tcp from any to 192.168.100.0/24 flags S/SA no state label "USER_RULE: WAN - TCP in"
    pass out quick on mvneta2 reply-to (mvneta2 192.168.100.1) inet proto tcp from 192.168.100.0/24 to any flags S/SA no state label "USER_RULE: WAN - TCP out"
    
    

    stateless_2020-09-27_11-43-55.png

    But nothing pass on LAN Out.

    mvneta1 = LAN
    mvneta2 = WAN

    I not connected directly to the link, my provider don't allow bridge connection.


Log in to reply