New NIC - Now can't access cable modem GUI
-
It's not needed since traffic to private IPs leaving WAN is not normally an issue. But in that scenario if a client on LAN tries to ping, for example, 10.100.0.1 that traffic will be passed and routed out of the WAN to the WAN gateway.
-
@stephenw10 said in New NIC - Now can't access cable modem GUI:
in that scenario if a client on LAN tries to ping, for example, 10.100.0.1 that traffic will be passed and routed out of the WAN to the WAN gateway.
if both the 'default deny' rule and the pass rule are configured with protocol 'any' (which i failed to consider in the details of my hypothetical)—that's true!
if, however, the 'default deny' rule is configured with protocol 'any' and the pass rule is configured only for protocol TCP/UDP, then that's not true.
regardless, i maintain my position that all of this is more succintly maintained on a per-interface basis.
-
I don't have a block outbound rule like that because I don't think it's necessary. But in more complex environments if you really don't want any traffic to private IPs leaving WAN it's the easiest way to ensure that. Maintaining all the rules on each interface if you're adding/removing subnets becomes significant work and open to error.
-
@stephenw10 said in New NIC - Now can't access cable modem GUI:
But in more complex environments if you really don't want any traffic to private IPs leaving WAN it's the easiest way to ensure that.
i suppose i could agree with that (sledgehammer-nail approach notwithstanding).
@stephenw10 said in New NIC - Now can't access cable modem GUI:
Maintaining all the rules on each interface if you're adding/removing subnets becomes significant work and open to error.
i also agree with that. friendly reminder to audit your rules regularly, folks!
i should also mention my view is likely skewed by using pfSense purely for edge routing and firewalling—only a /30 'transit' subnet configured on the LAN side connected directly to core router.
appreciate the spirited discussion on this (and with you too, @johnpoz).
-
On a hunch, I swapped the modem for one of the same model from my ISP. Problem is solved & I have GUI access once again. Chalking it up to coincidence with the modem failing at the same time NIC was replaced.
Thanks to everyone for your assistance.
