Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Basic config

    Scheduled Pinned Locked Moved
    General pfSense Questions
    5
    13
    2.4k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by

      You would setup the rules you want to limit your vpn users to on the vpn tab.

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.03 | Lab VMs 2.7.2, 24.03

      1 Reply Last reply Reply Quote 0
      • _
        _JT
        last edited by

        Ok, thanks. I'll see how far I can manage on my own, it looks quite easy!

        1 Reply Last reply Reply Quote 0
        • K
          kejianshi
          last edited by

          It comes ready for the web.  Very secure.

          But with a LITTLE knowledge, and a lot of work, you can make it unsecure…  (-:

          Be careful making pass rules and NAT rules.

          1 Reply Last reply Reply Quote 0
          • _
            _JT
            last edited by

            Yeah. I understand what you mean. I think I have at lease basic understanding of NAT en firewalling. It's just that I had to do so little I started to question myself wether I did enough :P

            1 Reply Last reply Reply Quote 0
            • _
              _JT
              last edited by

              I have found log entries that I can't really understand.

              
Act 	Time 				If 		Source 								Destination 				Proto
block	Dec 22 17:38:15 	LAN 	[fe80::c553:f712:d08e:c24a]:52859 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:15 	LAN 	[fe80::c553:f712:d08e:c24a]:52859 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:15 	LAN 	[fe80::c553:f712:d08e:c24a]:55029 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:15 	LAN 	[fe80::c553:f712:d08e:c24a]:50661 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:16 	LAN 	[fe80::c553:f712:d08e:c24a]:55029 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:17 	LAN 	[fe80::c553:f712:d08e:c24a]:55029 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:17 	LAN 	[fe80::c553:f712:d08e:c24a]:50661 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:17 	LAN 	[fe80::c553:f712:d08e:c24a]:50661 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:17 	LAN 	[fe80::c553:f712:d08e:c24a]:50661 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:19 	LAN 	[fe80::c553:f712:d08e:c24a]:60143 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:19 	LAN 	[fe80::c553:f712:d08e:c24a]:60143 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:19 	LAN 	[fe80::c553:f712:d08e:c24a]:60143 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:19 	LAN 	[fe80::c553:f712:d08e:c24a]:52859 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:19 	LAN 	[fe80::c553:f712:d08e:c24a]:52859 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:19 	LAN 	[fe80::c553:f712:d08e:c24a]:52859 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:19 	LAN 	[fe80::c553:f712:d08e:c24a]:55029 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:19 	LAN 	[fe80::c553:f712:d08e:c24a]:55029 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:19 	LAN 	[fe80::c553:f712:d08e:c24a]:55029 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:21 	LAN 	[fe80::c553:f712:d08e:c24a]:50661 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:21 	LAN 	[fe80::c553:f712:d08e:c24a]:50661 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:21 	LAN 	[fe80::c553:f712:d08e:c24a]:50661 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:23 	LAN 	[fe80::c553:f712:d08e:c24a]:53189 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:23 	LAN 	[fe80::c553:f712:d08e:c24a]:49836 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:23 	LAN 	[fe80::c553:f712:d08e:c24a]:55029 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:23 	LAN 	[fe80::c553:f712:d08e:c24a]:55029 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:23 	LAN 	[fe80::c553:f712:d08e:c24a]:55029 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:24 	LAN 	[fe80::c553:f712:d08e:c24a]:53189 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:24 	LAN 	[fe80::c553:f712:d08e:c24a]:49836 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:25 	LAN 	[fe80::c553:f712:d08e:c24a]:53189 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:25 	LAN 	[fe80::c553:f712:d08e:c24a]:49836 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:27 	LAN 	[fe80::c553:f712:d08e:c24a]:53189 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:27 	LAN 	[fe80::c553:f712:d08e:c24a]:53189 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:27 	LAN 	[fe80::c553:f712:d08e:c24a]:53189 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:27 	LAN 	[fe80::c553:f712:d08e:c24a]:49836 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:27 	LAN 	[fe80::c553:f712:d08e:c24a]:49836 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:27 	LAN 	[fe80::c553:f712:d08e:c24a]:49836 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:27 	LAN 	[fe80::c553:f712:d08e:c24a]:59761 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:27 	LAN 	[fe80::c553:f712:d08e:c24a]:55885 	[fec0:0:0:ffff::2]:53		UDP
block	Dec 22 17:38:28 	LAN 	[fe80::c553:f712:d08e:c24a]:59761 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:28 	LAN 	[fe80::c553:f712:d08e:c24a]:55885 	[fec0:0:0:ffff::1]:53		UDP
block	Dec 22 17:38:29 	LAN 	[fe80::c553:f712:d08e:c24a]:59761 	[fec0:0:0:ffff::3]:53		UDP
block	Dec 22 17:38:29 	LAN 	[fe80::c553:f712:d08e:c24a]:55885 	[fec0:0:0:ffff::3]:53		UDP

              These all seem to be IPv6 adresses. My guess would be that this is a portscan of some sort. But then I don't understand why if says "LAN" instead of "WAN"?

              1 Reply Last reply Reply Quote 0
              • stan-qazS
                stan-qaz
                last edited by

                I'm clueless about IPv6 addresses so I'm no help on them but port 53 and UDP sounds like an attempted DNS lookup to me.

                1 Reply Last reply Reply Quote 0
                • P
                  phil.davis
                  last edited by

                  That is a client using IPv6 looking hard for a DNS server:

                  A set of three well-known site-local IPv6 addresses are reserved
                  for autodiscovery of DNS servers.  These addresses may be used as
                  unicast addresses, assigned to different servers, or as anycast
                  addresses with one of them being assigned to all DNS servers in
                  the site, or any combination of anycast and unicast addresses.  In
                  any case, host routes are propagated in the site's routing tables.
                  This document proposes that these three addresses be
                  fec0:0:0:ffff::1, fec0:0:0:ffff::2, and fec0:0:0:ffff::3.  This
                  list of three addresses may be hardcoded into a host.

                  from: http://www.ietf.org/proceedings/52/I-D/draft-ietf-ipngwg-dns-discovery-03.txt
                  (and I suspect there are later versions of that draft standard)

                  As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                  If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                  1 Reply Last reply Reply Quote 0
                  • _
                    _JT
                    last edited by

                    Learned something new today guys, awesome. Thanks. Kind of weird that it is being blocked; I have no rules prohibiting any traffic inside the lan. I do not want to put up any restrictions inside the network. Should I create a firewall rule that says allow LAN <-> LAN?

                    1 Reply Last reply Reply Quote 0
                    • P
                      phil.davis
                      last edited by

                      You might need to go to System->Advnced, Networking tab, and check "Allow IPv6". Otherwise there is a block all IPv6 rule put in by the firewall that is probably the reason for that blocking.

                      As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                      If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                      1 Reply Last reply Reply Quote 0
                      • _
                        _JT
                        last edited by

                        Gonna take a look at that when I'm at the location again, thanks. I think I might just disable ipv6 inside the network completely; I'm guessing it has no added value whatsoever but the adresses are harder to remember :D

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post