Firewall not blocking specific hosts
-
I'm having issues with some rules, not sure of what is going on. I want to restrict esxi guis and idrac guis from all but 1 local ip address.
My current setup is the sg1100 connected to a switch on the lan side that has servers connected to the switch.
I have it set to any for the protocol and sorce any for the ports and single host on the destination and block.
This does not block the gui I have set. Does anyone have any ideas or things to try. I'd be greatly appreciative of any input.
-
@x12eape12x Show your rules, drag a screenshot here.
Also kill the firewall states.
Diagnostics -> States ->Reset States
-
Not sure how I can drag images off my phone. Give me a few to get on a pc.
-
ive messed with the ports and the rule looks correct to me.
-
heres the current rule setup. the other was an older screenshot. my bad
-
@x12eape12x as mentioned you need to check your states.
If you connect through the firewall and the traffic is allowed, a state is created. Until such time that state expires, closed by client/server or killed traffic would be allowed via the state even if you create a block rule.
So you need to check your states for stuff your attempting to block, and remove those states if you want your block rule to take effect.
Is this exsi on another vlan? I see your disabled rule there for source 192.168.1.28 to 192.168.1.32.. Which hints your trying to filter traffic that is on the same lan network? Traffic on the same vlan/network doesn't flow through pfsense. You can not stop client on network A from talking to another client also on network A. This traffic is not routed through pfsense.
-
Thanks I figured out the issue. Since everything was on the same gateway I'll have to use the opt port as a management and make it a different gateway. I was able to block esxi from all users though.
-
@x12eape12x said in Firewall not blocking specific hosts:
I was able to block esxi from all users though.
Again you can not block with pfsense devices on the same network.. So your esxi is on a different network as you users - or you blocked them via firewall on your esxi host?
-
@johnpoz I have it done through the host now. I'll get the opt port setup later today I'm just not by the device to do so now.
