OPT1 Firewall Rules
-
I've been unsuccessful in getting my OPT1 to gain Internet access, and I believe the reason being is in earlier editons of pfsense there was a choice for Source as OPT1.NET. But now the closest to it is OPT1 address and OPT1 subnets. Regardless of which choose, I'm unable to gain access to the Internet.
Can anyone help me with this issue?
-
Here is a basic rule set on my LAN.
Do other OPTs have internet access?
-
@turku31 your source would be opt1 subnets - address would never be source of traffic into the opt1 interface.
The only time it wouldn't be opt1 subnets is if you used this interface as a transit network and you had a downstream router attached. Then you would want a cidr there via network to allow for all the nets you had downstream.
-
@Uglybrian
I'm using it this way to keep my Stereo, Tv, etc., silioed from other devices on the network.
I am following the advice of a Naomi Brockwell's video on YouTube, who is well-versed on the topic, whereas I am only a newbie.
I had it working on OPNSense but I since have switched to pfsense. In either event, I have tried the two choices that had OPT1 in its description, but fails to connect. -
After creating your OPT1 did you enable it? same for the DHCP server for that segment.
Once you create a new interface you need to enable it and hit save at the bottom.
-
@turku31 said in OPT1 Firewall Rules:
but fails to connect.
And what firewall logs do you see? Out of the box the default deny is logged and would show you what traffic is hitting your interface and being denied.
but as mentioned - did you actually enable dhcp on this interface? Are you clients on this opt network actually getting an IP from pfsense for the network you put on your opt1 interface?
Common mistake I have seen when users creating a new interface, is it defaults to a /32 mask - which wouldn't work and wouldn't even allow you to enable dhcp, etc.
-
@johnpoz said in OPT1 Firewall Rules:
defaults to a /32 mask
I bet that is the hang up. I have made this mistake before.
-
@Uglybrian
So here are screenshots of pfsense firewall configurations for both OPT1 and OPT2. In the pfsense screenshot you don't see the choice of OPT1.NET for source; in the video screenshots, you do.
I am on version 2.8.1.
I believe this to be the crux of the matter. Unless there is a way creating this choice, I don't know.
-
@turku31 dude it hasn't be nets for many many versions now.. It has been subnets - I dont recall when they changed it.. But many many moons ago
And again it would never be address.. If your address on your opt1 interface was 192.168.66.1 - then that is what opt1 address would be... How would a rule to allow traffic into your opt1 network interface be itself??
How about you show us what your actual firewall rules are you have on opt1 - for all we know you have block rfc1918 clicked on it? What is the address you put on it. Is it a /24? Do you clients get an IP from dhcp? What does your log say when its not working - like from your client ping pfsense opt1 address?
edit:
I just found some idiot video on the internet that was for version 2.4.5 that shows nets vs subnets? Maybe that was the one you were looking at.. That idiot was creating a rule of source opt1 nets destination opt1 nets - and labeled it "allow access within subnet" <rolleyes> Why do idiots that do not have a clue put out shit videos showing how they don't understand what they are trying to show others to do?edit2: This idiot tech beatz has 777 subscribers? got to be kidding me..
edit3: This idiot shouldn't be within 100 feet of a firewall - let alone putting out videos to explain how to do things to others.
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 25.07.1 | Lab VMs 2.8.1, 25.07.1 -
@johnpoz said in OPT1 Firewall Rules:
idiot shouldn't be within 100 feet of a firewall
And still somehow said idiot will be able to get a job.. fake his/her way through it long enough.. get protected by a union so his/her employer will not be able to fire his/her *ss..
/soapbox
/rant
sorry.. long day.
-
@chpalmer hahaha - exactly ;)
-
@johnpoz said in OPT1 Firewall Rules:
@turku31 dude it hasn't be nets for many many versions now.. It has been subnets - I dont recall when they changed it.. But many many moons ago
John, how does one enable subnets, appears to still be nets in 2.6.x or early 2.7.x in the GUI?
All I see in the GUI is "... nets", no "... subnets".
-
@jdeloach really?? Maybe they changed in plus before.. Why would you still be running such old versions.. 2.6 is like from 22, and even 2.7.2 is going on 2 years old. 2.7 is no longer support even.
I know its been multiple updates back in plus.
-
Turku to be clear on your interface rules for the source you will want OPT1 net or OPT1 subnet. Your destination should be ‘’any’’. There are two different versions of PF Sense CE and Plus so some of the wording may be different. I don’t know. I am on the plus version.
But I don’t think this is your problem as you stated earlier, you’ve tried it both ways with net and addresses in the source. You need to go back and double or triple check other settings that are necessary for a new segment to work. Johnpoz has pointed out under interfaces the mask setting. Is your mask set to 24? If your mask is still a 32 it doesn’t matter what rules you put in the interface. It will not work.
-
@johnpoz
The idea is to 'silo' the networks--not allowing, separating them from one another, in this case, OPT1.NET to not have access to OPT2 or LAN.
All I know is, as shown in the screenshot, that it did exist, but no longer.
I was thinking if I reverted back to an earlier pfsense, say 2.7.2 version, where OPT1.NET still existed in the list, that when upgrading it would simply carryover and work in the 2.81 version.
Just a thought.
I don't know if it is permissible to post a link to YouTube but here is the link to what information I am trying to incorporate into my network.
https://www.youtube.com/watch?v=yKyjbeObQXg -
@turku31 why would you revert to get nets when its the exact same thing as subnets??
If you do not want opt 1 network to talk to lan net/subnet for example.. then create a rule blocking opt1 subnet from talking to lan net/subnet
If you do not want this network talking to any of your networks you could create multiple rules, or just create a alias with either all rfc1918 space in it, or your specific networks.
What do you want to allow this opt1 net/subnet to do and block it from doing and I will post up a simple picture of the rules you would set..
For example here these rules would block access from opt 1 to your lan network, and allow everything else
Clearly you would do this on your opt1 interface, where mine says test - substituting opt 1 subnets where mine says test subnets, etc.
Rules are evaluated top down, first rule to trigger wins, no other rules are evaluated.
edit: here is more advanced locked down network
It allows clients on this network to ping, dns and ntp to pfsense address on this network. It then blocks any other access to any other IP on pfsense (this would include pfsense public IP on the wan interface for example) This would prevent clients on this network from accessing the pfsense web gui or any other services on any pfsense IP.
It then blocks any access to any rfc1918 space (10.x, 192.168.x, 172.16-31.x) via an alias created that contains these networks.
It then allows anything else - ie internet.
Adjust as you see fit for your want/need for this network.
-
First off, OPT1 t is enabled. It is set for /24. Insofar as the logs go there are quite a few, even too many.
Yes, I did enable dhcp. -
@turku31 so what do the logs show???
-
Exactly lets see your rule set.. Lets see a log entry that you feel is wrong, or don't understand. What is not working exactly?
Do you have any rules in floating tab? These rules if set to quick would be evaluated before rules on the interface. If you are trying to block traffic.. If you have a state open already before you put in a block you would need to either wait for that state to time out, or kill it before your block would take effect.
Without some details, its not really possible for anyone to help you figure out what is not working the way you want it to work.
-
The simple answer is I have tried every option available, and none is able to connect to the Internet, short of Any, which would defeat the purpose.. And since the video link I posted, instructs you to choose OPT1.NET as the Source, it's not possible to do so if it doesn't exist.
Pardon my lack of knowledge regarding all this, but I will have to study what you've provided to gain a better understanding of what I can/should do to remedy it all.
I greatly appreciate your response.
