Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    block traffic between interfaces [Solved]

    Firewalling
    4
    27
    3.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mass
      last edited by johnpoz

      Hi,

      I have configured pfsense firewall with one WAN, one LAN, and one OPT1 interfaces and what i noticed is there is no restrictions between the internal inetrfaces both networks are communicating. and i want to block communication between these two internal interfaces.

      1 Reply Last reply Reply Quote 0
      • kiokomanK
        kiokoman LAYER 8
        last edited by kiokoman

        one way to do this:
        Create an alias for the RFC1918 network ranges. Call it private_networks and include the following ranges:

        10.0.0.0/8
        172.16.0.0/12
        192.168.0.0/16

        create a firewall rule on top of everything on the LAN and on the OPT1 tab with block and destination "Single host or alias" > private_network

        ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
        Please do not use chat/PM to ask for help
        we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
        Don't forget to Upvote with the 👍 button for any post you find to be helpful.

        1 Reply Last reply Reply Quote 0
        • M
          mass
          last edited by

          Created rule as per your sugestions but still no luck

          1 Reply Last reply Reply Quote 0
          • M
            mass
            last edited by

            Seems its working but lost internet connectivty for both networks

            1 Reply Last reply Reply Quote 0
            • kiokomanK
              kiokoman LAYER 8
              last edited by

              do you have a public ip on your wan or is it behind another modem/router with 192.168.x.x network?

              ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
              Please do not use chat/PM to ask for help
              we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
              Don't forget to Upvote with the 👍 button for any post you find to be helpful.

              1 Reply Last reply Reply Quote 0
              • M
                mass
                last edited by

                Its connected through router there is no Public IP.

                Now its working after changing the rule order for both the networks.
                but not able ping own gateway ips as well.

                1 Reply Last reply Reply Quote 0
                • kiokomanK
                  kiokoman LAYER 8
                  last edited by

                  modify the alias to be more specific, put inside only the network you have for the LAN and for the OPT1 interface

                  ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
                  Please do not use chat/PM to ask for help
                  we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
                  Don't forget to Upvote with the 👍 button for any post you find to be helpful.

                  1 Reply Last reply Reply Quote 0
                  • M
                    mass
                    last edited by

                    bf2cc1ab-8778-422a-b735-860798179c5c-image.png

                    this is the rule which i have created as per your advice.

                    1 Reply Last reply Reply Quote 0
                    • M
                      mass
                      last edited by

                      967174df-1774-4d01-9063-280b84ed46bd-image.png

                      Alias Internal_default_Addr

                      1 Reply Last reply Reply Quote 0
                      • M
                        mass
                        last edited by mass

                        But not able to ping own gateway IP.
                        Ex: if my lan network is 192.168.1.1/24 i am not able to ping 192.168.1.1 from the same notwork.

                        1 Reply Last reply Reply Quote 0
                        • kiokomanK
                          kiokoman LAYER 8
                          last edited by kiokoman

                          what addresses do you have in the wan, lan and opt1 interfaces?
                          another way to do that is to make a block rule with destination "OPT1 net" on the LAN tab and one block rule with destination "LAN net" on the OPT1 tab

                          ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
                          Please do not use chat/PM to ask for help
                          we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
                          Don't forget to Upvote with the 👍 button for any post you find to be helpful.

                          1 Reply Last reply Reply Quote 0
                          • M
                            mass
                            last edited by

                            WAN Configured as DHCP, WAN IP is 192.168.0.8/24.
                            LAN Network : 192.168.1.1/24
                            OPT1 : 192.168.100.1/24

                            1 Reply Last reply Reply Quote 0
                            • kiokomanK
                              kiokoman LAYER 8
                              last edited by kiokoman

                              maybe it's easier for you: another way to do that is to make a block rule with destination "OPT1 net" on the LAN tab and one block rule with destination "LAN net" on the OPT1 tab

                              ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
                              Please do not use chat/PM to ask for help
                              we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
                              Don't forget to Upvote with the 👍 button for any post you find to be helpful.

                              M 2 Replies Last reply Reply Quote 0
                              • M
                                mass
                                last edited by

                                Ok Will check.

                                What if i want to block all ports between these two networks and allow a specific port for a specific service?

                                Ex : Assume my ftp server is in LAN network and i want to allow only that ftp server with ftp port for OPT1 network . and all other ports should be blocked.

                                noplanN 1 Reply Last reply Reply Quote 0
                                • M
                                  mass @kiokoman
                                  last edited by

                                  This post is deleted!
                                  1 Reply Last reply Reply Quote 0
                                  • noplanN
                                    noplan @mass
                                    last edited by

                                    @mass said in block traffic between interfaces:

                                    y ftp server is in LAN network and i want to allow only that ftp server with ftp port

                                    for starters set an allow rule for the IP or the alias + port of your ftp server
                                    in front of your block rule ...

                                    rules are runnin top to bottom

                                    brNP

                                    M 1 Reply Last reply Reply Quote 0
                                    • M
                                      mass @noplan
                                      last edited by

                                      @noplan said in block traffic between interfaces:

                                      for starters set an allow rule for the IP or the alias + port of your ftp server
                                      in front of your block rule ...
                                      rules are runnin top to bottom
                                      brNP

                                      Ok

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        mass @kiokoman
                                        last edited by

                                        @kiokoman said in block traffic between interfaces:

                                        maybe it's easier for you: another way to do that is to make a block rule with destination "OPT1 net" on the LAN tab and one block rule with destination "LAN net" on the OPT1 tab

                                        Yes Its working ,
                                        Thanks a lot👍

                                        noplanN 1 Reply Last reply Reply Quote 0
                                        • noplanN
                                          noplan @mass
                                          last edited by

                                          @mass

                                          ftp workin to ?
                                          brNP

                                          M 1 Reply Last reply Reply Quote 0
                                          • M
                                            mass @noplan
                                            last edited by

                                            @noplan said in block traffic between interfaces:

                                            ftp workin to ?
                                            brNP

                                            Yes Its Working
                                            Thanks.....

                                            noplanN 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.