Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Pass rule blocked on default gateway on VPN

    Scheduled Pinned Locked Moved
    Firewalling
    3
    15
    367
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • randombitsR
      randombits @viragomann
      last edited by randombits

      @viragomann The two sites are in the context of the whitelists. The two sites are blocked by existing pfblocker lists so therefore, unblocked in the whitelist at the top of the rules. I assumed the lists would be 'parsed' being in the 999 vlan and passed out to Proton via the gateway at the bottom of the list.

      The idea is to have all torrent data go via proton including the two whitelisted sites. The torrent server is on another server but I was testing using wifi ssid's vlans.

      The default gateway in the wan.

      Incidentally, ALL the traffic goes over a single NIC on a tiny Lenovo server running Proxmox.

      ADSLModem VLAN 1000 > Switch >Proxmox >pfSense
      Wifi AP VLAN 999 . . . . . . .>^

      screencapture-192-168-2-210-firewall-rules-edit-php-2024-04-26-10_46_32.png screencapture-192-168-2-210-system-gateways-php-2024-04-26-10_36_40.png screencapture-192-168-2-210-firewall-rules-php-2024-04-26-10_36_55.png
      screencapture-192-168-2-210-pfblockerng-pfblockerng-category-php-2024-04-26-14_02_52.png
      screencapture-192-168-2-210-pfblockerng-pfblockerng-ip-php-2024-04-26-14_06_28.png

      randombitsR 1 Reply Last reply Reply Quote 0
      • randombitsR
        randombits @randombits
        last edited by randombits

        I've just added again the Proton gateway to each of the whitelist pass rules and seems to be working now - All very odd

        Swapping back and forth between to wifi ssid could have caused issues and stuck pfsense states ..

        V 1 Reply Last reply Reply Quote 0
        • V
          viragomann @randombits
          last edited by

          @randombits
          Not clear to me, why you got no connection before.
          As mentioned to whitelist rule would let out the traffic on WAN without the VPN gateway stated, since WAN is the default.
          But since this rule don't tag the traffic, it should not be blocked by the killswitch.

          So the only reason I can think of, is that the destination is blocked in the WAN, by your provider.

          randombitsR 1 Reply Last reply Reply Quote 0
          • randombitsR
            randombits @viragomann
            last edited by

            @viragomann Definitely not my ISP they don't anything ports,sites etc , for one it works ok via my ISP over my normal wifi ssid.

            What I think it was the rules were working but blocked from the default WAN via the tagged floating kill switch rule I'm not sure though.

            V 1 Reply Last reply Reply Quote 0
            • V
              viragomann @randombits
              last edited by

              @randombits
              But according to your screenshots, the whitelist rules don't tag the packets. So the kill-switch rule shouldn't be applied to them.

              randombitsR 1 Reply Last reply Reply Quote 0
              • randombitsR
                randombits @viragomann
                last edited by

                @viragomann Agreed, All very odd. Having been at this most of yesterday and now today I'll give it a rest for bit !. Thanks for making me think some more - sometimes another pair of eyes helps !

                randombitsR 1 Reply Last reply Reply Quote 0
                • randombitsR
                  randombits @randombits
                  last edited by

                  I forgot to add, the whole reason behind this I'm going to change to new fibre ISP that blocks a lot of sites and uses CGNAT😞 but faster that my current ADSL.

                  I still can't figure out what the original issue is/was though😕

                  Bob.DigB 1 Reply Last reply Reply Quote 0
                  • Bob.DigB
                    Bob.Dig LAYER 8 @randombits
                    last edited by Bob.Dig

                    @randombits said in Pass rule stopping internet on VPN:

                    I still can't figure out what the original issue is/was though😕

                    I don't think you can just add two FQDNs and everything is working. Even if you talk about just those two Websites, they will use additional FQDN and CDNs etc.
                    Also using this many "Feeds" for a torrent app is not smart to begin with. All those lists are not for torrenting, most of them are at least partially against it. Just Stop it. Don't use any blocklist for torrenting unless you find one specific for this and your usecase. I don't know one.

                    randombitsR 1 Reply Last reply Reply Quote 0
                    • randombitsR
                      randombits @Bob.Dig
                      last edited by randombits

                      @Bob-Dig The two sites are both in ip ranges and one in the DNS list. I wish to block some 'areas' I download and share torrents with. Admittedly they could be better trimmed more appropriately rather than just add from from the LAN.

                      The problems is with the pass rule list added with default gateway (*) it blocks and doesn't send out via the default gateway, when it's set to the gateway ProtonVPN it works ok, I have no idea why. It does the same if I manually add the pass rule to.

                      The whitelist rule is working but not going out via the default gateway

                      Apr 28 18:11:13,1770012439,vtnet0.999,TORRENTTRAFFIC,pass,4,17,UDP,10.9.99.10,104.31.16.4,55886,443,out,Unk,pfB_WhitelistDNS_v4,104.16.0.0/12,WhitelistDNS_custom_v4,Unknown,dave-PC,null,+
Apr 28 18:11:13,1770012439,vtnet0.999,TORRENTTRAFFIC,pass,4,17,UDP,10.9.99.10,104.31.16.4,55886,443,out,Unk,pfB_WhitelistDNS_v4,104.16.0.0/12,WhitelistDNS_custom_v4,Unknown,dave-PC,null,-
Apr 28 18:11:13,1770012439,vtnet0.999,TORRENTTRAFFIC,pass,4,17,UDP,10.9.99.10,104.31.16.4,55886,443,out,Unk,pfB_WhitelistDNS_v4,104.16.0.0/12,WhitelistDNS_custom_v4,Unknown,dave-PC,null,-
Apr 28 18:11:29,1770012439,vtnet0.999,TORRENTTRAFFIC,pass,4,6,TCP-S,10.9.99.10,162.159.137.6,24703,443,out,Unk,pfB_WhitelistDNS_v4,162.159.128.0/17,WhitelistDNS_custom_v4,Unknown,dave-PC,null,+
Apr 28 18:11:29,1770012439,vtnet0.999,TORRENTTRAFFIC,pass,4,6,TCP-S,10.9.99.10,162.159.137.6,24703,443,out,Unk,pfB_WhitelistDNS_v4,162.159.128.0/17,WhitelistDNS_custom_v4,Unknown,dave-PC,null,-
Apr 28 18:11:32,1770012439,vtnet0.999,TORRENTTRAFFIC,pass,4,6,TCP-S,10.9.99.10,172.66.44.77,24705,443,out,US,pfB_WhitelistDNS_v4,172.66.40.0/21,WhitelistDNS_custom_v4,Unknown,dave-PC,null,+
Apr 28 18:11:32,1770012439,vtnet0.999,TORRENTTRAFFIC,pass,4,6,TCP-S,10.9.99.10,172.66.44.77,24705,443,out,US,pfB_WhitelistDNS_v4,172.66.40.0/21,WhitelistDNS_custom_v4,Unknown,dave-PC,null,-
                      randombitsR 1 Reply Last reply Reply Quote 0
                      • randombitsR
                        randombits @randombits
                        last edited by

                        SOLVED

                        After a rethink I discovered no auto created outbound NAT rule (set to manual) added that and now everythings works as expected.

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post