Cannot Pass Spoofed IP between LAN interfaces
-
I'm running 2.0.3 with a LAN & OPT1 interface (which is being used for guest wireless.) This is for a school, so we're running a a web content filter to keep the kids from stumbling upon the occasional porn site. :o
I am having major problems getting pfSense to pass specific traffic from that filter on the LAN subnet to guest on the OPT1 subnet:
Here is what seems to be happening: When a guest tries to access a blocked site, the filter stops the session and then appears to reply back to the guest using the spoofed IP of the requested website.
In my pfSense firewall log I get 3 entries showing that it has blocked traffic on my LAN interface with a source IP that matches the IP of the requested websites.
The log shows that the rules that triggered the action were:
@1 scrub on em0_vlan10 all fragment reassemble
@1 block drop in log all label "Default deny rule".The problem is, that I cannot find any way to create a rule that will pass this traffic from my LAN interface to OPT1. I have even went as far as creating a rule that allows all/any traffic from the LAN interface with a destination of the OPT1 subnet, but it still blocks it citing the two rules listed above.
Any help would be GREATLY appreciated!!!
Thank you.