Is traffic between VLANs "statefully" firewalled or can it be made so?

PhrostByte

I am a long time Cisco ASA user, and I am configuring my first Netgate Pfsense 2100.

I only have minimal devices with which to do testing before I actually try to replace an ASS 5505 with this device, and I think I have only one remaining concern, for which I am not seeing an answer in the docs.

VLAN60 is my Internal Network and VLAN50 is my DMZ network. What I want is for each of them to be able to send any traffic to the Internet. I also want devices in VLAN50 to be able to initiate traffic to VLAN50 (so that internal clients can directly access the applications in the DMZ as well as Internet users), but I do NOT want ANY devices in the DMZ to be able to initiate traffic to any devices in VLAN50 (or for that matter any other "internal" VLANs that I may set up.

I have configured by VLAN60 as my Internal network and it can browse to the Internet just fine via:
ALLOW IPv4 from VLAN60-subnets to ANY

However, if I put a similar rule on VLAN50 then I would think that VLAN60 is a part of "ANY" therefore the DMZ servers would be able to initiate traffic to Internal clients/servers. This would be bad.

Now I was thinking of putting a rule ahead of this on VLAN50 such as this:
DENY IPv4 from VLAN50-subnets to VLAN60-Subnets
ALLOW IPv4 from VLAN50-subnets to ANY

However, my concern is that such a rule would block traffic trying to REPLY to VLAN60 for sessions that were originated from VLAN60.

Basically, I would like for there to be a stateful firewall between VLAN60 and VLAN50, just like there is between either of these 2 VLANs and the Internet.
In an ASA this was handles via assigning each VLAN(Interface) a "security level" where higher security levels had stateful firewalls between them and VLANS(Interfaces) of lower security levels.

I cant see where in the Pfsense docs whether such a firewall does, or can, exist between VLANs configured in Pfsense.

If you could point me to the documentation that describes this, and hopefully also configuration examples, it would be much appreciated.

Thanks,

johnpoz

@PhrostByte said in Is traffic between VLANs "statefully" firewalled or can it be made so?:

Basically, I would like for there to be a stateful firewall between VLAN60 and VLAN50, just like there is between either of these 2 VLANs and the Internet.

There is.. All traffic that the firewall allows creates a state, the return traffic is allowed by the state.

edit:
you can look at your states under diagnostic menu, states.

SteveITS

@PhrostByte said in Is traffic between VLANs "statefully" firewalled or can it be made so?:

DENY IPv4 from VLAN50-subnets to VLAN60-Subnets
ALLOW IPv4 from VLAN50-subnets to ANY

That is what you need.

However, my concern is that such a rule would block traffic trying to REPLY to VLAN60 for sessions that were originated from VLAN60.

It will not, pf is stateful.
https://docs.netgate.com/pfsense/en/latest/monitoring/status/firewall-states.html

If you block access to pfSense IPs (This Firewall alias), remember to allow DNS, :53 tcp/udp.

SteveITS

Posted that and then remembered the new Ethernet rules are stateless.

https://docs.netgate.com/pfsense/en/latest/firewall/ethernet-rules.html#stateless

johnpoz

@SteveITS said in Is traffic between VLANs "statefully" firewalled or can it be made so?:

Posted that and then remembered the new Ethernet rules are stateless.

But those just allow or block traffic before it hits an interface where rules would have to allow or deny anyway, which would create a state..

I have not played with them - but if they bypassed the L3 rules - that could be bad juju.. But I think the default deny is disabled when you enable L2?

I really should spend some time playing with these.. But I just don't have any valid use for them.

So if I create a ethernet rule to allow all, but there is no L3 rules, then all traffic would be allowed? That could be very dangerous if you do not fully understand that..

hmmm - you could maybe lock yourself out of the gui with ethernet rules, even with the L3 anti-lock out rule.. Yeah I should do some playing with these for sure.

stephenw10

Yup VLANs are treated like any other interface in pfSense. The firewall rules on the interfaces apply to all traffic entering them and are stateful by default.

It's possible to create stateless rules there if you need to for some obscure reason but you have to try hard.