<![CDATA[Firewall Blocking VLAN Traffic default deny rule IPv4 (1000000103)]]>I am using a Netgate SG1100. Traffic over my VLAN just started getting blocked by the firewall with a default deny rule IPv4 (1000000103). Where is that coming from. It was working. I didn't change anything.

I deleted all my firewall rules for the VLAN and added an all open rule. Still does not work. Cant get any internet traffic on the VLAN

alt text

Firewall Log sample....

alt text

Has anyone run into this?

]]>https://forum.netgate.com/topic/165665/firewall-blocking-vlan-traffic-default-deny-rule-ipv4-1000000103RSS for NodeTue, 16 Jun 2026 06:30:08 GMTFri, 06 Aug 2021 22:28:03 GMT60<![CDATA[Reply to Firewall Blocking VLAN Traffic default deny rule IPv4 (1000000103) on Tue, 10 Aug 2021 14:30:50 GMT]]>I figured out, that my problem seams to be a different one. I opened a separate topic to avoid confusion: https://forum.netgate.com/topic/165738/allow-rule-not-working

]]>https://forum.netgate.com/post/996301https://forum.netgate.com/post/996301Tue, 10 Aug 2021 14:30:50 GMT<![CDATA[Reply to Firewall Blocking VLAN Traffic default deny rule IPv4 (1000000103) on Tue, 10 Aug 2021 12:32:51 GMT]]>@johnpoz
Thanks for confirming!
Then at least with my latest reconfiguration I shouldn't run into problems (only about half of the 400.000 used).
I'll keep an eye on those default deny blocks and will see if they are gone now.

Thank you

]]>https://forum.netgate.com/post/996277https://forum.netgate.com/post/996277Tue, 10 Aug 2021 12:32:51 GMT<![CDATA[Reply to Firewall Blocking VLAN Traffic default deny rule IPv4 (1000000103) on Tue, 10 Aug 2021 12:22:54 GMT]]>Those numbers are what your looking for max table entries.

You can also view them with

pfctl -vvs Tables

Use of pfblocker and yeah for sure bogon v6 can get to very large number of entries very quickly.

if you run into a problem with loading the rules you should get a very noticeable error - in the top right of the screen..

]]>https://forum.netgate.com/post/996272https://forum.netgate.com/post/996272Tue, 10 Aug 2021 12:22:54 GMT<![CDATA[Reply to Firewall Blocking VLAN Traffic default deny rule IPv4 (1000000103) on Tue, 10 Aug 2021 12:08:57 GMT]]>@froglevelmc
yeah I already search for CLI commands but didn't find anything use full. Only in the webinterface under diagnostics -> tables you can see the tables and the number of their entries. But I'm not sure if this relates to the "Firewall maximum table entries" setting. If I sum up all the tables I'm at roughly 180.000 -> only half of the 400.000. But again: I'm not sure if it's valid to compare those numbers.

]]>https://forum.netgate.com/post/996267https://forum.netgate.com/post/996267Tue, 10 Aug 2021 12:08:57 GMT<![CDATA[Reply to Firewall Blocking VLAN Traffic default deny rule IPv4 (1000000103) on Tue, 10 Aug 2021 12:04:37 GMT]]>@b_chris
Yeah I searched a little but did not really find much.
My guess is you wont find anything in the GUI.
It will likely have to be done from the CLI via SSH or the console port. I know that some of those address tables can get very large such as the IPv6 bogon lists. It exceeded the old default of 200k so the developers had to increased the default to 400k..... The IPv6 list alone I am sure will exceed even the 400k default before too long.

]]>https://forum.netgate.com/post/996266https://forum.netgate.com/post/996266Tue, 10 Aug 2021 12:04:37 GMT<![CDATA[Reply to Firewall Blocking VLAN Traffic default deny rule IPv4 (1000000103) on Tue, 10 Aug 2021 11:44:38 GMT]]>It would really be interesting to see how "full" the firewall table is with the current config.
I didn't touch "Firewall Maximum Table Entries" so far (--> default 400.000) but I have no clue whether I'm at 5% or 99%...

]]>https://forum.netgate.com/post/996263https://forum.netgate.com/post/996263Tue, 10 Aug 2021 11:44:38 GMT<![CDATA[Reply to Firewall Blocking VLAN Traffic default deny rule IPv4 (1000000103) on Tue, 10 Aug 2021 11:41:39 GMT]]>@froglevelmc
Ah ok, I didn't get the notification bell. Strange.

All my VLANs that should have access to the internet can access it.
In the logs I saw one client (smart home device) that ran into the default deny all the time. And that affected VLAN had an allow everything (source, destination, protocol etc. set to *) rule for testing purpose. So my expectation was, that this VLAN should never ever hit the default deny rule

]]>https://forum.netgate.com/post/996261https://forum.netgate.com/post/996261Tue, 10 Aug 2021 11:41:39 GMT<![CDATA[Reply to Firewall Blocking VLAN Traffic default deny rule IPv4 (1000000103) on Tue, 10 Aug 2021 11:35:47 GMT]]>@b_chris said in Firewall Blocking VLAN Traffic default deny rule IPv4 (1000000103):

May I ask where you found the error message about the not loaded rules? I'm asking because I didn't find any error messages that where related to firewall rules but I may have missed something.

The error messages I got were in the notification bell at the top right of the menu bar just to the left of the logout icon.

Are any of your VLANs getting internet?

]]>https://forum.netgate.com/post/996259https://forum.netgate.com/post/996259Tue, 10 Aug 2021 11:35:47 GMT<![CDATA[Reply to Firewall Blocking VLAN Traffic default deny rule IPv4 (1000000103) on Tue, 10 Aug 2021 11:12:31 GMT]]>@froglevelmc thank you for the reply.
May I ask where you found the error message about the not loaded rules? I'm asking because I didn't find any error messages that where related to firewall rules but I may have missed something.
Also in my case I observed only one client that was/is affected by triggering the default deny rule even though this shouldn't be the case when looking at my ruleset.

In the meantime I reduced the selected IP-filters in pfBlockerNG and for the moment the message seams to be gone but I'd like to make sure, that I faced really the same issue like you...

]]>https://forum.netgate.com/post/996255https://forum.netgate.com/post/996255Tue, 10 Aug 2021 11:12:31 GMT<![CDATA[Reply to Firewall Blocking VLAN Traffic default deny rule IPv4 (1000000103) on Tue, 10 Aug 2021 11:06:55 GMT]]>@b_chris said in Firewall Blocking VLAN Traffic default deny rule IPv4 (1000000103):

@froglevelmc I was about to post the same problem. I'm using GeoIP for inbound traffic but no snort. On multiple VLANs I'm using pfBlockerNG lists to block outbound traffic and that might be the problem.

How did you figure out, that you reached the 40.000 limit? I couldn't find any according status.
Any downside of setting the limit higher? I assume, it "only" costs more RAM?

Thanks

Yep it just allocates a little more memory for your rules.

As far as how I figured it out by making assumptions. I started getting messages that about 15 or so pfblocker rules could not load because memory could not be allocated. I started searching that error and found that raising the firewall max table size would resolve those errors and I made the connection that my allow rules for the VLAN may not be loading for the same reason made the change and within a few seconds the VLAN clients had internet access. I just added in extra zero to see if that was gonna correct the issue it. 4 million may be a little too much and I'll be backing mine down a bit. I would just raise it to 500k then 600k, etc. until the issue is resolved.

I would think that there is some way to ascertain how many files are actually getting loaded in the that table, but I don't know how to. Also I have not read through the pfblocker documentation, They may already have suggested settings for running it in pfsense.

]]>https://forum.netgate.com/post/996254https://forum.netgate.com/post/996254Tue, 10 Aug 2021 11:06:55 GMT<![CDATA[Reply to Firewall Blocking VLAN Traffic default deny rule IPv4 (1000000103) on Sun, 08 Aug 2021 19:40:42 GMT]]>@froglevelmc I was about to post the same problem. I'm using GeoIP for inbound traffic but no snort. On multiple VLANs I'm using pfBlockerNG lists to block outbound traffic and that might be the problem.

How did you figure out, that you reached the 40.000 limit? I couldn't find any according status.
Any downside of setting the limit higher? I assume, it "only" costs more RAM?

Thanks

]]>https://forum.netgate.com/post/996049https://forum.netgate.com/post/996049Sun, 08 Aug 2021 19:40:42 GMT<![CDATA[Reply to Firewall Blocking VLAN Traffic default deny rule IPv4 (1000000103) on Sat, 07 Aug 2021 15:32:37 GMT]]>@froglevelmc Glad to see you got it sorted out.

]]>https://forum.netgate.com/post/995908https://forum.netgate.com/post/995908Sat, 07 Aug 2021 15:32:37 GMT<![CDATA[Reply to Firewall Blocking VLAN Traffic default deny rule IPv4 (1000000103) on Sat, 07 Aug 2021 03:21:53 GMT]]>@kom Well. I think I figured out what happened... I have pfblocker GEOIP filter, and snort running. I believe I exceeded my max firewall table entries. I had it set to the default 40000. I changed it to 4000000 and it started working again. I guess the rule VLAN rules were not loading because the table was full.

]]>https://forum.netgate.com/post/995850https://forum.netgate.com/post/995850Sat, 07 Aug 2021 03:21:53 GMT<![CDATA[Reply to Firewall Blocking VLAN Traffic default deny rule IPv4 (1000000103) on Fri, 06 Aug 2021 23:54:47 GMT]]>@froglevelmc DNS is being blocked but your rules should allow it. Do you have any rules on the floating tab? What changed from when it was last working to when it stopped working? You're sure you have pfSense DNS listening on that interface?

]]>https://forum.netgate.com/post/995842https://forum.netgate.com/post/995842Fri, 06 Aug 2021 23:54:47 GMT