Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Basic config

    Scheduled Pinned Locked Moved
    General pfSense Questions
    5
    13
    2.5k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • _
      _JT
      last edited by

      Ok, thanks, I read about all incoming traffic being blocked by default. I do not want to control any outgoing connection, my aim is to create our own cloud. I will use a Synology NAS for the cloud service and as an LDAP server. So if my install is now ready for basic routing and firewalling then the next step would be to setup VPN services including all associated certificate stuff like a CA and certificates per user. I read that the certificates need to have the same CN as the LDAP user so I think I'm ok. Only need to find out how I can block users accessing any other devices than the NAS.

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        You would setup the rules you want to limit your vpn users to on the vpn tab.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        1 Reply Last reply Reply Quote 0
        • _
          _JT
          last edited by

          Ok, thanks. I'll see how far I can manage on my own, it looks quite easy!

          1 Reply Last reply Reply Quote 0
          • K
            kejianshi
            last edited by

            It comes ready for the web.  Very secure.

            But with a LITTLE knowledge, and a lot of work, you can make it unsecure…  (-:

            Be careful making pass rules and NAT rules.

            1 Reply Last reply Reply Quote 0
            • _
              _JT
              last edited by

              Yeah. I understand what you mean. I think I have at lease basic understanding of NAT en firewalling. It's just that I had to do so little I started to question myself wether I did enough :P

              1 Reply Last reply Reply Quote 0
              • _
                _JT
                last edited by

                I have found log entries that I can't really understand.

                
Act 	Time 				If 		Source 								Destination 				Proto
block	Dec 22 17:38:15 	LAN 	[fe80::c553:f712:d08e:c24a]:52859 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:15 	LAN 	[fe80::c553:f712:d08e:c24a]:52859 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:15 	LAN 	[fe80::c553:f712:d08e:c24a]:55029 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:15 	LAN 	[fe80::c553:f712:d08e:c24a]:50661 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:16 	LAN 	[fe80::c553:f712:d08e:c24a]:55029 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:17 	LAN 	[fe80::c553:f712:d08e:c24a]:55029 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:17 	LAN 	[fe80::c553:f712:d08e:c24a]:50661 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:17 	LAN 	[fe80::c553:f712:d08e:c24a]:50661 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:17 	LAN 	[fe80::c553:f712:d08e:c24a]:50661 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:19 	LAN 	[fe80::c553:f712:d08e:c24a]:60143 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:19 	LAN 	[fe80::c553:f712:d08e:c24a]:60143 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:19 	LAN 	[fe80::c553:f712:d08e:c24a]:60143 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:19 	LAN 	[fe80::c553:f712:d08e:c24a]:52859 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:19 	LAN 	[fe80::c553:f712:d08e:c24a]:52859 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:19 	LAN 	[fe80::c553:f712:d08e:c24a]:52859 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:19 	LAN 	[fe80::c553:f712:d08e:c24a]:55029 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:19 	LAN 	[fe80::c553:f712:d08e:c24a]:55029 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:19 	LAN 	[fe80::c553:f712:d08e:c24a]:55029 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:21 	LAN 	[fe80::c553:f712:d08e:c24a]:50661 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:21 	LAN 	[fe80::c553:f712:d08e:c24a]:50661 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:21 	LAN 	[fe80::c553:f712:d08e:c24a]:50661 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:23 	LAN 	[fe80::c553:f712:d08e:c24a]:53189 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:23 	LAN 	[fe80::c553:f712:d08e:c24a]:49836 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:23 	LAN 	[fe80::c553:f712:d08e:c24a]:55029 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:23 	LAN 	[fe80::c553:f712:d08e:c24a]:55029 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:23 	LAN 	[fe80::c553:f712:d08e:c24a]:55029 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:24 	LAN 	[fe80::c553:f712:d08e:c24a]:53189 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:24 	LAN 	[fe80::c553:f712:d08e:c24a]:49836 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:25 	LAN 	[fe80::c553:f712:d08e:c24a]:53189 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:25 	LAN 	[fe80::c553:f712:d08e:c24a]:49836 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:27 	LAN 	[fe80::c553:f712:d08e:c24a]:53189 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:27 	LAN 	[fe80::c553:f712:d08e:c24a]:53189 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:27 	LAN 	[fe80::c553:f712:d08e:c24a]:53189 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:27 	LAN 	[fe80::c553:f712:d08e:c24a]:49836 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:27 	LAN 	[fe80::c553:f712:d08e:c24a]:49836 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:27 	LAN 	[fe80::c553:f712:d08e:c24a]:49836 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:27 	LAN 	[fe80::c553:f712:d08e:c24a]:59761 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:27 	LAN 	[fe80::c553:f712:d08e:c24a]:55885 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:28 	LAN 	[fe80::c553:f712:d08e:c24a]:59761 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:28 	LAN 	[fe80::c553:f712:d08e:c24a]:55885 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:29 	LAN 	[fe80::c553:f712:d08e:c24a]:59761 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:29 	LAN 	[fe80::c553:f712:d08e:c24a]:55885 	[fec0:0:0:ffff::3]:53		UDP

                These all seem to be IPv6 adresses. My guess would be that this is a portscan of some sort. But then I don't understand why if says "LAN" instead of "WAN"?

                1 Reply Last reply Reply Quote 0
                • stan-qazS
                  stan-qaz
                  last edited by

                  I'm clueless about IPv6 addresses so I'm no help on them but port 53 and UDP sounds like an attempted DNS lookup to me.

                  1 Reply Last reply Reply Quote 0
                  • P
                    phil.davis
                    last edited by

                    That is a client using IPv6 looking hard for a DNS server:

                    A set of three well-known site-local IPv6 addresses are reserved
                    for autodiscovery of DNS servers.  These addresses may be used as
                    unicast addresses, assigned to different servers, or as anycast
                    addresses with one of them being assigned to all DNS servers in
                    the site, or any combination of anycast and unicast addresses.  In
                    any case, host routes are propagated in the site's routing tables.
                    This document proposes that these three addresses be
                    fec0:0:0:ffff::1, fec0:0:0:ffff::2, and fec0:0:0:ffff::3.  This
                    list of three addresses may be hardcoded into a host.

                    from: http://www.ietf.org/proceedings/52/I-D/draft-ietf-ipngwg-dns-discovery-03.txt
                    (and I suspect there are later versions of that draft standard)

                    As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                    If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                    1 Reply Last reply Reply Quote 0
                    • _
                      _JT
                      last edited by

                      Learned something new today guys, awesome. Thanks. Kind of weird that it is being blocked; I have no rules prohibiting any traffic inside the lan. I do not want to put up any restrictions inside the network. Should I create a firewall rule that says allow LAN <-> LAN?

                      1 Reply Last reply Reply Quote 0
                      • P
                        phil.davis
                        last edited by

                        You might need to go to System->Advnced, Networking tab, and check "Allow IPv6". Otherwise there is a block all IPv6 rule put in by the firewall that is probably the reason for that blocking.

                        As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                        If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                        1 Reply Last reply Reply Quote 0
                        • _
                          _JT
                          last edited by

                          Gonna take a look at that when I'm at the location again, thanks. I think I might just disable ipv6 inside the network completely; I'm guessing it has no added value whatsoever but the adresses are harder to remember :D

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post