Block traffic between networks
-
@steveits WIFI and OpenVPN should not talk to LAN. I followed your suggestion and I believe everything is working as intended but I'm still testing. One thing to note is that I'm using tun0 device under OpenVPN and I don't actual have a OpenVPN interface as this gets dynamically created, so when it comes down to create rules and specify destination I need to use IP/CIDR instead of selecting the network from the drop down menu as there is no entry for OpenVPN.
-
What is confuse is that as per Pfsense docs "rules on interface tabs are applied on a per-interface basis, always in the inbound direction on that interface", but in fact I'm adding outbound rules to allow certain traffic to pass out. Is all traffic blocked by default or there is a need to have a BLOCK ALL at the end of each interface rule tab?
-
@hfarinha said in Block traffic between networks:
don't actual have a OpenVPN interface as this gets dynamically created, so when it comes down to create rules and specify destination I need to use IP/CIDR instead of selecting the network from the drop down menu as there is no entry for OpenVPN
I believe that is correct in that setup. But it should show as a tab in Firewall Rules so you can create rules on that interface...to block from OpenVPN to other networks.
-
@hfarinha said in Block traffic between networks:
per Pfsense docs "rules on interface tabs are applied on a per-interface basis, always in the inbound direction on that interface", but in fact I'm adding outbound rules to allow certain traffic to pass out.
Semantics...you create a rule on WIFI to handle packets arriving on the WIFI interface. You tell pfSense to allow from WIFI Net to Any, so it lets the packet in and routes it to the Internet. It goes out on the WAN interface.
Is all traffic blocked by default or there is a need to have a BLOCK ALL at the end of each interface rule tab?
All interfaces block by an implicit block rule. LAN is created with an allow to any rule, as one assumes LAN will likely need to get to places including pfSense itself. Other interfaces do not have that rule by default.
-
@steveits it makes sense thank you for the explanation. In terms of allowing internet access from WIFI/OpenVPN, the only way I found was to allow destination to any (*), however this implies allowing traffic to any other net. Instead of * I wish there was a "INTERNET" net so I don't have to explicit block traffic to individual nets if you get what I mean.
-
@hfarinha You can always allow "not local" ip's.
like not 192.168.0.0/16As for vpn its a good idea to assign an interface to openvpn, do you can also see traffic, assign specific rules etc.
Remember to restart openvpn after assignment. -
@hfarinha said in Block traffic between networks:
I wish there was a "INTERNET" net
Which would be ANY ;) you want a alias to list every and all possible networks out of all of IPv4 space..
-
@netblues the reason I didn't assign ovpns1 interface in pfsense is because somehow OpenVPN worked fine since I setup years ago but it makes sense what you are saying and it seems that pfsense docs also suggest this for better flexibility. So I did that, I assigned ovpns1 and called it 'VPN'.
Then I restarted OpenVPN service and now under Firewall rules I see the new interface 'VPN', however and strange enough, the previous "interface" where I was adding rules related to the vpn traffic is still there "OpenVPN" and traffic is flowing as normal even if VPN interface has no rules at all atm.(see attached picture)
-
@hfarinha lets see your nic assignment page.
You would assign an interface when you create a client connection on pfsense, but when you just setup pfsense server on pfsense, it auto creates that openvpn interface where you would setup rules for what remote clients can access.
edit:
Here I connected to my vpn with phone, could ping 192.168.3.10.. I then created a firewall rule on that interface, set it to log.. Can not ping now, and its logged blocked with the interface being the vpn instance that it connected too.
-
@johnpoz oh, this is not a site to site VPN, this a vpn client on my android phone. It's not connected all the time.
-
@hfarinha exactly see my edit showing you how to block any remote client talking to anything on your network.
If you advertise to your remove clients your local networks, or you set client to send everything down the vpn and you connect. By default the openvpn interface that is created is any any rule.
If you don't want your remote clients talking to stuff, just create the rule like any other interface.
Top down, first rule to trigger wins, no other rules evaluated - this is inbound just like any other interface rule. From your remote client ---> vpn server..
-
openvpn will create the general openvpn firewall rule either on a server or a client, or many of them
Then rules on the openvpn are applied globally
It comes handy in some occasions
Assigning a specific interface both in client and server scenarios allows for more granular control of firewall rules.
And you can also add the interfaces into traffic monitor and see graphs.
As a rule if you use assigned interfaces you should move rules to specific interface tab. Otherwise it becomes confusing/ -
@hfarinha here, I connected via different vpn instance (different port).. And that same openvpn interface and its rules are used.
Notice this block is from different tunnel network 10.0.8 vs 10.0.200 and the "interface" is opvn1 vs 2 in my previous pic
If you want to block only specific clients, just setup the clients to always get the same IP when they connect, etc. This is easy enough to do with the client specific overrides tab in the vpn setup area.
-
my confusion at this point is not how to allow/deny traffic but how I assign an interface for openvpn as suggested.
here's my nic assignment:
I want to configure all VPN fw rules under the newly assigned 'VPN' nic however I can't get rid of "OpenVPN" under FW rules. I have no rules under VPN nic and vpn traffic still flow as normal so it seems that rules under OpenVPN are still in effect as I'm allowing traffic there.
-
@hfarinha vpns1 is the first openvpnserver, vpns2 the second etc
vpnc1 is the first vpnclient interface vpnc2 the second etc.As simple as that
-
@hfarinha said in Block traffic between networks:
but how I assign an interface for openvpn as suggested.
There is little reason to assign an interface for remote clients connecting to pfsense as server. The global openvpn interface works for your remote access rules, be it you have 1 instance running or multiple instances running.
But you would assign those interfaces here.
But that really is only something you would do if pfsense is the client to some vpn server/service somewhere.
See above my ns1vpn interface and what its assigned too.
-
I only have one VPN client however I don't see any new interface being created when I establish the tunnel from remote client.
Here's what I did, I assigned interface ovpns1 and called it "VPN" (as explained before).
Then I recreated all the rules I had under "OpenVPN" in "VPN". Then I disabled all rules under "OpenVPN" and now everything works as it was before. This actual fixed a long time issue that I was having with 'DNS resolver' service. Before assigning the new interface I could not enable this service for VPN remote users, so I had to manually push (via openvpn tunnel config) upstream resolvers to the vpn client. Now with the new interface assigned and added to 'DNS resolver' I no longer need to do this. I now have "OpenVPN" with no rules and I don't think I can delete it. -
@hfarinha You cant delete it. Just move the rules and it will be fine
-
@hfarinha said in Block traffic between networks:
new interface being created when I establish the tunnel from remote client.
Who said there would be?
This actual fixed a long time issue that I was having with 'DNS resolver' service
If you want remote vpn users to use unbound running on pfsense, you just need to create a ACL that allows the tunnel network.. Unbound automatically creates ACLs to allow networks its attached to ask unbound for dns. Tunnel networks are not included in these auto acls, so if you want remove vpn uses to ask unbound, you just need to create a ACL in the unbound settings to allow.
-
@johnpoz said in Block traffic between networks:
auto acls
I'm not sure about those "auto acls" from unbound as I don't see them in any place, however I added rules to allow DNS traffic to each of the firewall GW IPs and everything is working as expected.Thank you all!
