Block 1 IP client while on LTE Wan Backup interface
-
@johnpoz said in Block 1 IP client while on LTE Wan Backup interface:
@iptvcld you might have to have created a new state... I would test with some other device that wont have the kids screaming..
You have no rules for dns, where does the shield point to for dns? If it pointed to pfsense IP for example, you forcing it out a gateway before you allow it to talk to pfsense would prevent dns from working, etc.
Take a look at the policy route bypass I linked too.. You should have rules above policy routing that allows access to either pfsense IPs or other networks before you shove traffic out some gateway that can not get to these things.
And your block rules is kind of wrong underneath your policy route, it should just be a deny, it shouldn't really be a policy route.
Hmmm. Yes I may need to add an allow rule from lan net to my dns server:53 at the top
-
@johnpoz so if I put an allow rule at the top of LAN as source block alias and destination DNS IP:53 and then put the 2 gateway rules under that. Would this indicate that the nvidia would be allowed to hit the dns server on any gateway and then the dns server blocks the nvidia if it sees it going out on the lte WAN?
-
@iptvcld what? Just set your rule to only allow access to lan address 53 tcp/udp.. Now anything on the lan can use this pfsense for dns. Or set it to allow any for dns.. But if nvidia wasn't using pfsense for dns then your rule would of worked allowing it out the pppoe.
Dns server doesn't block anything... So nvidia asks dns hey whats the IP for www.something.com, oh its 1.2.3.4 makes a connection to 1.2.3.4 on whatever port it was wanting to make a connection on.
Pfsense say oh nvidia IP your trying to go to something.. Here go out this gateway to get there..
If your pppoe is down, that rule wouldn't be there.. See the post about checking that box when your gateway is down.
This next rules say oh hey nvidia your trying to go to 1.2.3.4, sorry this rule says to block you.
Dns only part was letting nvidia know the IP address for www.something.com
Remember rules are evaluated top down, first rule to trigger wins, no other rules are evaluated.
-
@johnpoz excellent explanation, thank you. The screenshot I first sent with the 2 rules disabled, I now understand why that would not work as first of all there was no allow to elevate DNS (external outside of pfsense) and then that first rule was being met and no other rules were being evaluated.
I will put this all together this evening and test it out. Thank you.
-
@iptvcld said in Block 1 IP client while on LTE Wan Backup interface:
no allow to elevate DNS (external outside of pfsense)
if your client would of been pointing to some dns it could get to through pppoe wan then it would of worked.. My guess is your shield would of been asking pfsense IP for dns, which is what the default dhcp server on pfsense hands out.. Which while you could get to an IP out on the internet, you couldn't even look up what IP to go to for www.something.com
-
@johnpoz This is how i setup based on the feedback you provided and i performed a test by failing over my PPPOE WAN to LTE Backup and my test device had no internet connectivity. I then restored my PPPOE Wan and the connection resumed.
I am allowing that LTE Block Host DNS access to my DNS Servers on port 53
Then I am allowing LTE Block Host alias internet access via PPPOE WAN
And if PPPOE WAN goes down, then I have that block rule in place that will block LTE Block Host alias to have LTE WANThank you for your help again!
-
@iptvcld and again that block, your third rule should not have a gateway on it.. Did you check the box I showed you in screen shot? If not if wan pppoe goes down, then the rule will just be there without the gateway in rule 2 and would allow access through whatever gateway is up.
Why do you have another alias, for dns shouldn't it just point to pfsense lan IP? So just use the built in alias lan address.
-
@johnpoz yes, I checked that box you mentioned as well. And for the 3rd rule, I will remove the gateway as you right, it’s just a redundant option since it’s a block all rule anyways for that alias.
As for the DNS Server alias, I have 2 DNS servers (nextDNS) that I am self hosting on a Ubuntu container and those are are listening on port 53. So in pfsense, I have those 2 dns server IPs for all my dhcp clients to hand out. Pfsense is just doing my local host overrides for my domain.
-
@iptvcld ah ok so these dns servers are on some different vlan/network than this lan network.. Because if they are on the network the client is on, they would never go through pfsense to get to them.
Make sure you actually test that this works how you want it to work before you call it done ;)
edit:
On a bit of side note there was another thread today about someone sucking up their whole LTE quota 2GB in like 20 days without even moving data over it.. Do you have such a quota?Thinking about it - there might be quite a few people that have such lte backups and background traffic might be eating through their quota and either when they do need it they only have small amount left, and if they go over they get charged or dropped to a slower tier..
-
@johnpoz sorry can you explain a bit more on this?
if they are on the network the client is on, they would never go through pfsense to get to them.My DNS servers are on the MGMT vlan/network 10.200.x.x and my lan is on 192.168.x.x. So if my dns server was in my lan network, why would they never go through pfsense? Your saying they would just talk directly to the dns servers? What about my MGMT clients I have now? They are bypassing pfsense? Is this a bad thing? If I had rules set for MGMT clients, when they all be bypassed?
-
@iptvcld Why would you think that some device on 192.168.1.x/24 would need to send traffic to pfsense to go to 192.168.1.y/24
A gateway is to get off a network, when a client wants to talk to an IP - oh that is on my network, arp and send it the mac address I get back.. When the IP is not on their network.. Oh need to send this my default gateway or some gateway I have a route for to get to that network.. Arp for the mac of that gateways IP and send the traffic to the gateway..
So yeah if your dns server was the same network as the device wanting to ask the dns server something, no it wouldn't send anything to pfsense the gateway/router to get off the network to some other network.
-
@johnpoz and is this a negative thing? If it does not need to pass through pfsense? Would the rules still be processed for the clients that are on the same network as the dns servers?
-
@iptvcld No the rule would never see traffic, it would never trigger.. Not sure what your not grasping that client doesn't send traffic to pfsense if the what it wants to talk to is on the same network as it..
Is it a negative thing? Lack of understanding the basic concept sure.. Traffic never gets sent to the gateway when devices talk amongst themselves on the same network.. Not grasping this concept leads to users creating rules that would never ever trigger and never be used.. When they do that and do not understand this concept, it leads to not understanding why something isn't working or is even though they are blocking it per how they think the rules work.. This is the big "negative" if you will.
-
@johnpoz understood, but this should be ok as the clients on the network where the dns servers are would just bypass pfsense for the purpose of resolving DNS. Once they resolve the address via DNS and need to exit in order to access the internet, they will come back to pfsense.
-
@iptvcld yeah.. To get off your local network, you have to talk to some router that will route that traffic for you - ie pfsense.
-
@johnpoz thanks again and sorry if it takes me a bit long to grasp. I enjoy playing with my home lab tech and I am learning a ton on the way from this community and people like you.
-
@iptvcld No problem - happy to help.. The only thing that gets frustrating sometimes, is man just answered the same exact question 3 days ago ;) does nobody know how to search a forum or even browse a few pages of threads... I get it sometimes understanding the search term can be a problem..
But I do not recall such a question, at least not any time recent..
So when you get a chance I would fully test that his works exactly how you want.. I would for example pull the plug on your pppoe connection and make sure your other clients work over your lte connection except for this one client your wanting to block..
