Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    firewall without NAT

    General pfSense Questions
    7
    40
    625
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • O
      olivier demoustier @SundarNET 0 last edited by

      @sundarnet-0
      Hi SundarNet, The lighting console has only 1 nic. So all this broadcast ( on port 6454 and 9000) passes in/out 1 nic on that end. This meaning , only 1 IP adress.

      S 1 Reply Last reply Reply Quote 0
      • O
        olivier demoustier @stephenw10 last edited by

        @stephenw10 IP range is 2.x.x.x subnet 255.0.0.0

        1 Reply Last reply Reply Quote 0
        • O
          olivier demoustier @NOCling last edited by

          @nocling
          I do not think a VLAN will solve this. But I'm more than happy to learn how you would solve this with a VLAN. Can a VLAN read a packet and look if it comes from port 6454 and if so ignore this packet?

          1 Reply Last reply Reply Quote 0
          • O
            olivier demoustier @NOCling last edited by

            @nocling
            Sorry, everything needs to be in the same subnet. (2.x.x.x. /8)
            We cannot change this.

            V 1 Reply Last reply Reply Quote 0
            • O
              olivier demoustier last edited by

              If I bridge WAN-LAN, all traffic passes, so the hardware is working. But whatever FIREWALL-rule I add, all traffic keeps on passing. I have set "net.link.bridge.pfil_bridge" to 1 and "net.link.bridge.pfil_member" to 1
              Was hoping this would solve it... but :( no luck

              1 Reply Last reply Reply Quote 0
              • V
                viragomann @olivier demoustier last edited by

                @olivier-demoustier said in firewall without NAT:

                @nocling
                Sorry, everything needs to be in the same subnet. (2.x.x.x. /8)
                We cannot change this.

                If both interfaces of pfSense have to be within a single subnet you have to bridge them, as @stephenw10 already mentioned.
                Doing this enables also broadcasts between the devices. Maybe this is what you need.

                O 1 Reply Last reply Reply Quote 0
                • O
                  olivier demoustier @viragomann last edited by

                  @viragomann

                  Thank you, I tried this, (look at my recent post) but then it just works as a 2port switch. FIREWALL-rules are not working

                  1 Reply Last reply Reply Quote 0
                  • V
                    viragomann last edited by

                    @olivier-demoustier said in firewall without NAT:

                    But whatever FIREWALL-rule I add, all traffic keeps on passing. I have set "net.link.bridge.pfil_bridge" to 1 and "net.link.bridge.pfil_member" to 1
                    Was hoping this would solve it... but :( no luck

                    It should work with these settings. Maybe you have zo kill existing states before testing.

                    1 Reply Last reply Reply Quote 0
                    • O
                      olivier demoustier last edited by

                      At last, I found it. Don't know why, but in bridge mode you need to reboot the firewall after you change a rule.
                      Will test further. But for the moment I have 1 rule to enable or disable all traffic. If You change this rule, you need to reboot.
                      To everybody, thank you so much for all the help.

                      AKEGEC 1 Reply Last reply Reply Quote 0
                      • AKEGEC
                        AKEGEC @olivier demoustier last edited by

                        @olivier-demoustier said in firewall without NAT:

                        At last, I found it. Don't know why, but in bridge mode you need to reboot the firewall after you change a rule.
                        Will test further. But for the moment I have 1 rule to enable or disable all traffic. If You change this rule, you need to reboot.
                        To everybody, thank you so much for all the help.

                        Happy for you. Don't forget to enable the auto start for all vlan bridges.

                        O 1 Reply Last reply Reply Quote 0
                        • O
                          olivier demoustier @AKEGEC last edited by

                          @akegec
                          mmm, don't know what you are saying. I don't use any VLANs. Or is a bridge some kind of VLAN?

                          AKEGEC 1 Reply Last reply Reply Quote 0
                          • stephenw10
                            stephenw10 Netgate Administrator last edited by

                            You need to set the filtering sysctls before you create the bridge. So if you change them afterwards you need to re-create the bridge. A reboot does that.

                            Steve

                            O 2 Replies Last reply Reply Quote 1
                            • O
                              olivier demoustier @stephenw10 last edited by

                              @stephenw10
                              Thanks Steve. Was not sure if I was doing wrong. This explains it.

                              KOM 1 Reply Last reply Reply Quote 0
                              • KOM
                                KOM @olivier demoustier last edited by

                                @olivier-demoustier Lastly, existing firewall states are not affected by a rule addition or change. Those states need to be cleared via Diagnostics - States in order for the new/modified rule to take effect. This trips a lot of people up when they make a rule and it doesn't seem to do anything. Rebooting the firewall does the same thing as resetting states but in a brute-force way. Glad to hear you got it working.

                                O 1 Reply Last reply Reply Quote 0
                                • O
                                  olivier demoustier @KOM last edited by

                                  @kom
                                  Thank you for explaining. But would be nice if the software would do this automatically when you hit 'apply". Or at least a pop up saying that you need to do that......?

                                  KOM 1 Reply Last reply Reply Quote 0
                                  • KOM
                                    KOM @olivier demoustier last edited by

                                    @olivier-demoustier I hear you. After applying the rule, it should be possible to go through the state table and nuke any states that match a firewall rule. An option could be added to the rule list page to reset existing states on Apply after add/edit. There is likely a technical reason I'm ignorant of as to why this isn't done. Perhaps for performance reasons like having to wait another 5-10s more (depending on your CPU) than you already have to wait every time you modify the rules. Perhaps the dynamic nature of the table and how it works makes this difficult or impossible. I don't know. But I do know that this is fairly obvious and smarter people than I have been working on this for a long time so there must be a reason.

                                    O 1 Reply Last reply Reply Quote 0
                                    • O
                                      olivier demoustier @KOM last edited by

                                      @kom
                                      Or just add a second apply button. One without and one with the extra actions needed....

                                      1 Reply Last reply Reply Quote 0
                                      • S
                                        SundarNET 0 @olivier demoustier last edited by

                                        @olivier-demoustier how do you get different paths ie wifi and LAN into the lightbox sorta indicates having wifi and LAN NICS? therefore it should have 2 IP addresses how is it specificially set up lightbox connected to ? via a switch or ? as you are trying to isolate 2 different port ranges in one path or channel eg only one NIC, sorta pointless as that traffic needs to pass through a NIC to get to the light box and different ports if you are trying to isolate traffic need to travel through separate NICs to not conflict or congest said NIC, my thought to do this would be a NAT redirect for one port to go via one NIC and the other port to be redirected to the 2nd NIC but you have not been clear with your actual config, I could be wrong but its how I would do it 2 NIC in light box 2 IP addresses with a separate NAT redirect for each needed port or port range

                                        O 1 Reply Last reply Reply Quote 0
                                        • AKEGEC
                                          AKEGEC @olivier demoustier last edited by

                                          @olivier-demoustier it was late and my eyes were half closed, sorry for confusion. Steve explained what I was trying to say. @stephenw10 thanks man.

                                          1 Reply Last reply Reply Quote 0
                                          • O
                                            olivier demoustier @SundarNET 0 last edited by

                                            @sundarnet-0
                                            1 pictures speaks a 1000 words
                                            This is the setup (simplefied) .
                                            The lighting consoles have only 1 NIC for all types of communication like Artnet, sACN, OSC, Telnet, UDP remoting, TCp remoting..........

                                            setup.jpg

                                            1 Reply Last reply Reply Quote 1
                                            • O
                                              olivier demoustier @stephenw10 last edited by

                                              @stephenw10

                                              Just ran into another problem here. Maybe someone can help me out?
                                              So I made a bridge and have only 1 firewall rule that passes all traffic.
                                              Screenshot 2021-05-26 162400.jpg
                                              Part of the traffic is "sACN" It is a multicast UDP E1.31based signal (more info here https://artisticlicence.com/WebSiteMaster/Publicity/HelpDesk18-sACN-in-large-systems-Part1-Nov2018.pdf)
                                              After a few minutes (without any reason or changes) this part stops working. As far as I can see, all other protocols keep passing the firewall.
                                              someone any idea why?

                                              1 Reply Last reply Reply Quote 0
                                              • stephenw10
                                                stephenw10 Netgate Administrator last edited by

                                                You might need to check 'allow IP Options' on the pass rule there:
                                                https://docs.netgate.com/pfsense/en/latest/firewall/configure.html?highlight=multicast#ip-options

                                                Steve

                                                1 Reply Last reply Reply Quote 1
                                                • First post
                                                  Last post