Can I disable packet filtering while still keeping NAT to white list countries?
-
I currently use pfBlocker to white-list countries that can reach our network (pfBlockerNG/IP/IPv4), where I use GeoIP lists from maxmind to allow the IP blocks that I need from the desired countries.
If I disable packet filtering will that still work? Also I read that it disables NAT, and we have NAT rules that do port forwarding.
I'm asking cause we have VOIP box that sometimes fails to connect some calls and the company behind it is telling us our firewall is randomly inspecting packets and that it blocks some of these packets which causes calls to randomly fail to connect.
-
@paul2019 you can but yes it will break stuff.
https://docs.netgate.com/pfsense/en/latest/troubleshooting/locked-out.html?highlight=pfctl#disable-the-firewallThere’s probably a better way to solve the problem. Can you provide more details?
Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
Upvote 👍 helpful posts! -
@steveits I have to disagree. How can GEOIP lists from pfBlockerNG be respected/blocked, if you have disabled pffilter?
pfBlockerNG just builds aliases - lists af IP addresses - that are used in firewall rules to block incoming and outgoing connections. -
Spoiler : pfSense's pf (packet filter - FreeBSD main firewall) does also NAT.
That makes NAT without pf a no go ......
edit
SteveITS is right, though :@steveits said in Can I disable packet filtering while still keeping NAT to white list countries?:
it will break stuff.
-
@steveits Hi Steve. Basically we have been getting quite a few SIP errors lately (code 486 Busy Everywhere) and we have Fortivoice Enterprise unit, so I did some packet capture and contacted support which replied back to me:
"I discussed the [TCP ZeroWindow] situation with a Level 2. This symptom likely indicates there's packet inspection on the firewall. It's intermittent/random because packet inspection does not block every packet, but will block some here and there as the firewall inspects them. For this reason, it would be best to disable inspection on the firewall for all traffic between phones/softclients and the FortiVoice."
-
@paul2019 what inspection do you think pfsense would be doing? Are you running IPS?
-
@gertjan That's what I was afraid of, we need the firewall working to white list the countries that we need, else we get so much crap SIP traffic from the internet that is unbelievable.
-
@johnpoz To be honest with you I have no clue, I only know how to do a basic setup on pfsense, install pfblocker, add the geo-ip lists and then add the port forwardings, that's about it my knowledge.
-
@paul2019 not sure what "inspection" pfsense would be doing unless your running IPS package - snort or suricata?
Its a simple layer 3 firewall - to do really any inspection of traffic and say this is bad or this is not bad from signature or something you would need to be running one of the IPS packages.
-
@johnpoz said in Can I disable packet filtering while still keeping NAT to white list countries?:
@paul2019 not sure what "inspection" pfsense would be doing unless your running IPS package - snort or suricata?
Its a simple layer 3 firewall - to do really any inspection of traffic and say this is bad or this is not bad from signature or something you would need to be running one of the IPS packages.
Gotcha, yeah I'm not running any of these packages, all I installed was pfblocker, my setup is super basic.
-
@paul2019 if DF is set on a packet that it really shouldn't be on those could get dropped I guess.
I believe there are many people around here that run sip and voip stuff that might have more experience with it than me.
Do you have these captures you could post, you sniff on wan and lan at same time to see specific if pfsense was dropping a packet and not passing it on to the lan side?
-
@johnpoz said in Can I disable packet filtering while still keeping NAT to white list countries?:
@paul2019 if DF is set on a packet that it really shouldn't be on those could get dropped I guess.
I believe there are many people around here that run sip and voip stuff that might have more experience with it than me.
Mine is unchecked, so that's correct?
-
@johnpoz We also use this setup to get the calls working correctly, do you think disabling NAT just here on the NAT Outbound entry would help?
-
@paul2019 no... Your natting a public IP? How would it work if you don't nat unless you were just routing public IP space..
Are you devices behind pfsense using public IP space? That is routed to you?
-
@johnpoz My devices are behind pfsense which is behind a router with a static public IP address.
This setup above, the netgate support helped me up with last year (I had paid support back then), when I had some issues with calls not having audio at all, after they added that entry everything worked fine. -
@paul2019 in that scenario pfsense itself was behind a nat. So pfsense was natting to some rfc1918 address that your edge router handed it..
Yeah a double nat could be very problematic to voice stuff..
-
@johnpoz Gotcha, FO100E happens to the the VOIP hardware unit here.
So this is doing double NAT?
If so then I need to check that "Do not NAT" on this entry to stop it from doing it, and see if that breaks the VOIP audio or not.
-
@paul2019 unless your isp device (edge router) is handing pfsense a public IP.. Then yeah your behind a double nat.
If its handing pfsense a public IP, and your device is getting rfc1918 from pfsense how would you turn off nat and expect anything to work.
Even if pfsense is getting rfc1918 from the edge router, is this edge router going to nat some different network? And then how would it know to send it back to pfsense? Your edge router would need to just nat anything it saw on its lan side to whatever its public Is, etc.
If they helped you last year and has been working - what exactly changed?
-
@johnpoz Yes it does handle a public IP to pfsense. The only change they did was to change the NAT to hybrid and add the entry as show above.
-
@paul2019 and your saying that was working.. So what changed?
If you disable nat and pfsense has a public IP lets say 1.2.3.4 on its wan.. And you disable nat, then it would send traffic from whatever the IP of your device is - say 192.168.1.X -- and your isp device is natting this also your public IP?
