Prevent Information Leaks
-
Hello,
I have installed pfSense 2.8.1 on a virtual machine with one network card. My goal is:These rules ensure your internal network configuration isn't accidentally exposed to the public internet.
Block Private Traffic from Leaving WAN: This prevents your firewall from accidentally sending packets destined for a private IP address out of its public interface. This can happen if a VPN connection drops.
The Alias is:
The Rule is:
Is this correct?
Thank you.
-
@hack3rcon said in Prevent Information Leaks:
Block Private Traffic from Leaving WAN:
Your pfSense doesn't have a WAN, just one LAN :
-
Hello @Gertjan,
My VM NIC is connected to the Internet. -
Your firewall rule is a block "out" (so outgoing traffic (?)) from LAN.
It blocks all traffic with destination "RFC1918".
Afaik, "RFC1918" can't be routed over the Internet, so I don't understand why you want to block traffic that can't be routed to anybody on the Internet.That said : these 'one NIC' setups, I've no experience with these.
About the "Prevent Information Leaks" question : you remember what info you've given to set up pfSense ?
It's "admin", a password, and maybe a mail address.
pfSense doesn't contain : your address, your social security number, bank info, names, or anything else.
What info can pfSense leak ? -
@Gertjan Someone told me about it. So, is this not necessary?
-
@hack3rcon What do you want with only one interface? This makes no sense at all. Maybe look for another hobby.
-
@hack3rcon said in Prevent Information Leaks:
So, is this not necessary?
No not really - but let say you had an actual wan.. Your own network rfc1918 would never leak because why would pfsense send traffic out for your own local network out its wan. What could go out your wan is if you asked for some other rfc1918 address that is not local.. My work laptop tries this all the time when its vpn is off - it tries to talk to the rfc1918 addresses in the work network and without the vpn, it just gets routed, pfsense does not know where to send traffic to get to say 10.0.0.42 when its local network is 192.168.1.0/24 for example - so it would send it out its default gateway (your isp via wan).
Is this a leak? Your isp is not going to route that is for sure - other than to maybe a local network in your isp network. Who would see this traffic other than your ISP.
Why would you care that that anyone could see that you tried to talk to a 10.0.0.42 address.. They sure can not talk to you with that IP, even if it was your local network.. My local lan network is 192.168.9.0/24 my pfsense IP is 192.168.9.253, my current PC I am using is 192.168.9.100 - what are you going to do with that info? Its like telling you my address is 123 main street. You know how many 123 main streets there are. Same with rfc1918 space..
I have such a rule myself - but its not about a leak. Its about being a good netizen and not sending noise out the internet to my isp. There is zero point to sending traffic to my example 10.0.0.42 address.. Because even if my isp had something on that address I could get to - it sure not the something I want to talk to. It sure wouldn't be able to route it to my work network. So why put noise on the internet?
Do you "need" such a rule - no..
edit: but I am curious what your trying to do with pfsense with only a lan interface?
-
Seems likely you are planning to add a VPN to that instance? And if so you're trying to prevent traffic leaving unencrypted if the VPN goes down?
If so that's not the way to do it.
-
@stephenw10 seems this is the same guy with wanting to setup tor, only has 1 interface and getting errors.. He should prob just start over.. Doesn't seem like he is actually using pfsense as router/firewall between his actual network and his isp.
I believe this is just a vm - But yeah he seems to be all over the place.. I sure shouldn't be worried about "leak" of my local network address space if can't even ssh to the thing or having errors about libssl, etc.
Or maybe he is posting from his phone? But clearly he is all over the place.
@hack3rcon what I would do is reset.. What exactly do you want this pfsense install to do - just be your tor gateway? Do you have another router for your actual network, is it pfsense?
If I wanted to run a tor gateway on my network - pfsense wouldn't be my choice, its a highly customized version of freebsd, with its own repository.. Adding packages that are not part of the pfsense repository is asking for problems. Trying to use it in a way that it was not intended, ie 1 interface hosting some service is not it intended use case.
The guide you linked to for tor gateway on pfsense is for a ancient version 2.5 - and clearly calls for 2 interfaces right at the top of the guide - your post shows only 1, etc.
-
@hack3rcon said in Prevent Information Leaks:
My goal is:
These rules ensure your internal network configuration isn't accidentally exposed to the public internet.
@Gertjan said in Prevent Information Leaks:
Your pfSense doesn't have a WAN, just one LAN :
@hack3rcon said in Prevent Information Leaks:
My VM NIC is connected to the Internet.
For pfsense to function as a firewall between one of your internal network segments and the internet, you need to set up your lan configuration so pfsense is positioned between this network segment and the internet.
This is probably most easily done by configuring two virtual networks in your hypervisor. In the hypervisor connect
- Both to pfsense VM, then in pfsense VM you will be able to configure one as LAN and the other as WAN
- Connect your protected Network devices to the LAN Hypervisor virtual network and no other network interface. All devices in that segment will then have network access controlled / restricted by pfsense
- Connect the interface connected to pfsense WAN interface to an internet accessible connection (such as behind your main router / firewall)
Variant of the above are also possible such as router on a stick (using VLAN to achieve two network connections) or using pfsense as your main router. Hopefully the above is a starting point.
-
Hello @Patch,
So, with a network card I don't have to worry about that? -
Hello @stephenw10,
How can I implement that scenario? -
@hack3rcon said in Prevent Information Leaks:
So, with a network card I don't have to worry about that?
No.
Using a physical or virtual NIC makes no difference.
The important point is if you want your firewall to control internet access, then you must configure your network so there is no other path for internet access other than through your firewall.
My point is that simple.
-
@hack3rcon What exactly are you trying to achieve here? What's your end goal?
Privacy Policy · Cookie Policy