Obtained ip from dhcp lan is blocked by firewall



  • Hello, i have dhcp running o my lan

    when i obtained the ip adress (136...225) from a client i can access the intenet inside the client

    but i have a problem i cant figure it out

    i have a webserver running on port 9999 ( or 80 it does not make a difference )
    but the firewall is blocking it
    if i disable the firewall temporarily i can access the port 9999

    i tried many options in lan rules but nothing worked

    how can i create a rule to allow access to port 9999 for the lan dhcp ip ?

    alt text


  • Galactic Empire

    pfSense != OPNsense

    Suggest you ask here:-

    https://opnsense.org/


  • LAYER 8 Global Moderator

    Other than using that distro that will not be named here..

    Your blocking on SA, ie syn,ack - this screams out of state traffic and asymmetrical traffic flow.

    First question I would ask is what IPs are you using internal on your network? 81.x and 136.x are not rfc1918 space.. You shouldn't be using public space you do not own, even if internally..

    But blocking of SA means that the firewall did not see the SYN (S) to create the state. This is normally because of some asymmetrical routing problem.

    How did 81 talk to 136 on port 9999? If not through your stateful firewall so it could create a state, then yes the return traffic sent to your firewall - ie the SA, would be blocked because it doesn't match a state.


Log in to reply