New pfsense install VLAN outbound getting blocked by default deny rule
-
I've been using pfsense in my home network for a number of years. I just got some new hardware and decided to start completely from scratch for fun. Installed with basically no config other than the bare minimum to allow traffic to work. No special firewall rules. So far so good.
Then I decided I wanted to do something I haven't done before, which is segregate my work laptop from the rest of my network. So, I set up an OPT interface and assigned a VLAN ID. Then I went into my switch, tagged the the pfsense port with both the default VLAN and my new VLAN ID. I then untagged the port my laptop is connected to with the work VLAN ID.
Finally, I setup DHCP on the new OPT interface and set up basic firewall rules to allow all traffic from WAN to OPT and from OPT to WAN. I also set firewall rules to block LAN traffic to OPT and from OPT to LAN. At this point, I'm just looking for basic connectivity before I do anything more fancy.
I confirmed my work laptop gets an IP address in the DHCP range of the correct VLAN subnet and I can ping the pfsense router IP on the same subnet without issue.
However, I have absolutely no internet connectivity. Everything trying to go out is getting blocked by the default deny IPv4 rule and I am at a loss as to why. I tried the suggestions in https://docs.netgate.com/pfsense/en/latest/troubleshooting/asymmetric-routing.html, but everything continues to get dropped by the default deny rule, even with explicit allow rules.
Any ideas? I'm happy to provide any additional information.
-
@thatrogueitguy did you add allow rules?
https://docs.netgate.com/pfsense/en/latest/solutions/netgate-4200/opt-lan.html
-
I do not think you want a rule to allow all from WAN.
A picture of the rules would help.
-
I did create allow rules on the OPT interface. Here's a picture of the current rules:
-
@thatrogueitguy The first and last rule can never trigger since rules apply as packets arrive on an interface. Nothing from "WAN subnet" can arrive on OPT2.
Also, WAN subnet is the WAN's local network...so allowing from OPT2 subnet to WAN subnet is not the same as "to any" i.e. the Internet. See the doc page I linked for example rules.
OPT2 subnet to OPT2 subnet is mostly useful since it would allow pinging or DNS to the pfSense OPT2 IP address.
-
The WAN to OPT2 was added for troubleshooting, since I wasn't getting any internet connection.
And yes, the OPT2 to OPT2 was added to allow for DNS and pinging to the pfsense.
Updated rules but still no internet access:
-
@thatrogueitguy You are still only allowing Opt2 to the WAN network, you want to allow opt2 to * so it can go beyond the WAN interface. The destination should be *.
Also the deny rule should be first.
-
OH!
I keep thinking WAN address is "internet" but that's not correct. The other piece I was missing was putting the deny rule to LAN at the top.
That did the trick. Works perfect now. Thank you!
-
@thatrogueitguy your opt2 sub to opt2 subs is not a very well define rule.. While it would allow you access to pfsense IP on the opt2 interface.. Pfsense has zero to do with device X on opt2 from talking to device Y on opt2.
Would be better if that rule destination was opt2 address. This would be clearer in what it is actually doing.
-
Ah, thank you! That's a good idea. I'll adjust that to be more specific.
