- help- how i can block access to webgui manager from interface wireless?

[robertog]

hello to everybody
i need to block access from interface wireless to pfsense i explain better:

my pfsense is 192.168.2.1
wireless client dhcp (192.168.2.2-254)

so i want to block from any client wireless to access pfsense (192.168.2.1)

thanks in advances

[GruensFroeschli]

I assume you have a rule on your WLAN interface looking something like:
allow; source: wlan-subnet, destination: any

change this rule to three rules:
#1: allow, source: any, destination: WLAN-interface, destination-port: 68-69
#2: allow, source: wlan-subnet, destination: WLAN-interface, destination-port: 53
#3: allow, source: wlan-subnet, destination: !WLAN-interface
–> destination: NOT WLAN-interface

With rule 3 you allow access to everywhere (internet) except the WLAN-interface.
With the rules 1 and 2 you allow DHCP and DNS to the pfSense.
You can combine the rules 1 and 2 if you use aliases.

[robertog]

thanks a lot GruensFroeschli I will try this evening

[robertog]

hello GruensFroeschli,
my setup is this:
allow, tcp/udp, wireless net, any, any, 53
allow tcp, wireless net, any, any 80
allow tcp, wireless net, any, any, 443

so in this case, from any wireless is possible to see pfsense (192.168.2.1).
I dont know how I can block it.
Can u help me?
thanks

[GruensFroeschli]

change the destination of your rules with ports 80 and 443 from any to !WLAN-interface

[robertog]

thanks a lot I will try later

[robertog]

hello GruensFroeschli,
sorry i continue to have problems.. :(
can u help me if I dont disturb?

thanks!

[ptt]

Please post a Screenshot of your LAN Rules

(You can attach the IMG directly to the forum,in "post reply" just use the "Advanced options" –> Attach)

[robertog]

hello ptt!
I did screenshot so I hope now better…

thanks

[ptt]

Just add a rule (on top of all others):

Action: Block

Proto: TCP

SRC: Wireless Net

Port: Any ( * )

Destination: Wireless Address

Port: 80

PS: from where you are ?

[GruensFroeschli]

well yeah that would work too.
but a more elegant solution is to simply change the third rule in your screenshot.
change the destination from "any" to "WLAN-interface" and check the "NOT" checkbox.

[robertog]

Thanks!
I did following instructions GruensFroeschi and now is working!!!

thanks again!

[yottabyte]

@GruensFroeschli:

well yeah that would work too.
but a more elegant solution is to simply change the third rule in your screenshot.
change the destination from "any" to "WLAN-interface" and check the "NOT" checkbox.

GruensFroeschli,

There is no "WLAN-interface" option from the destination type dropdown.  Please explain what it is that you're talking about as I would like to try your method.  Thanks.

[ptt]

Which name have your WLAN interface ?

[yottabyte]

What?

[ptt]

You should choose your assigned interface name as destination of the rule

You never will see "WLAN-interface" unless you give that name to your WLAN interface…

[yottabyte]

@ptt:

You should choose your assigned interface name as destination of the rule

You never will see "WLAN-interface" unless you give that name to your WLAN interface…

My wireless interface is named WAP.  The only options that I get from the "destination type" dropdown are: any, Single host or alias, Network, PPTP clients, PPPoE clients, L2TP clients, WAN subnet, WAN address, LAN subnet, LAN address, WAP subnet, and WAP address.  No option is given to select the WAP interface.

[ptt]

WLAN-interface = WAP address

wlan-subnet = WAP subnet

[yottabyte]

Thanks ptt, but if that is so then why GruensFroeschli not just say so?  Why use ambiguous terminology?  He said "change the destination from "any" to "WLAN-interface" and check the "NOT" checkbox," and that is what confused me to no end.  Anyhow, I'll give this a try and see if it works.  I'd rather have allow rules than block rules.

[ptt]

Maybe he should say "WLAN-address " instead of "WLAN-interface"

change the destination from "any"

to "WLAN-address" and check the "NOT" checkbox

Using the "NOT" you have a "2in1" rule, it "Allow" and also "Block" at the same time ;)

But, anyway it is understandable, IMHO