Inconsistent creation of default FW rules when building within HyperV
-
Hi,
On sharing some of my lab build details for pfSense, I received feedback to advise that some steps were not working. On investigating, we found the following:
- When building a virtual pfSense FW (release pfSense-CE-2.4.5-RELEASE-p1-amd64), in HyperV, before installation, we had set 4 interfaces on the FW, and these were detected as WAN, LAN, OPT1 and OPT2 (expected)
- Following the build, and before any custom rules were created, a host connected to the same vSwitch as FW OPT1 could not communicate with the OPT1 interface (tested with ICMP and HTTP). arp -a showed OPT1 MAC address in hosts arp cache. All IP addressing confirmed as OK.
- Moving host briefly to the same vSwitch as LAN, addressing accordingly, and browsing to pfSense GUI, we saw that there were no default rules on OPT1, nor OPT2. This may be expected.
However.... all of my previous builds (last week and earlier), where I ran through my own lab build steps myself, resulted in default rulesets being present after pfSense install. OPT1 and OPT2 had IPv4 any (protocol), any (src), any (dst) - different to LAN default rules, which consisted of anti-lockout, IPv4 any any any, and IPV6 any any any.
One hypothesis is that I have lost my mind, and actually created the OPT1 and OPT2 rules myself - however I strongly believe I did not do that. Testing my own build guide myself now, however, I get the same results (no default rules on OPT1 nor OPT2).
Second hypothesis is that HyperV has maybe updated recently (there was an OS upgrade), and the way that the installer interacts with HyperV has resulted in OPT1 and OPT2 not having default rules now (which does seem far-fetched... but this is niggling me...)Any thoughts appreciated on this. I am tempted to try builds on older Win10 and HyperV versions to see, but that way could lie further madness...
In short - what is the expected outcome of building with additional interfaces (more than 2) - is it expected under normal circumstances that the OPTx interfaces start off with default rules?
Many thanks,
-
@DMease That's like old news...we're on 2.7...
-
@DMease by default only LAN has rules.
-
@SteveITS cheers :-) muchly appreciated
That leaves me with the other option of me at some point configuring the OPT1 and OPT2 rules, in a way which I wouldnt normally configure them, then forgetting about it. Trip to the docs on the cards......
Labbing multiple scenarios and builds can mess with your head - at least I have an answer now!