• I have managed to fumble my way through the install and logged into the web interface but I'm struggling to route traffic correctly from my incoming connection to its destination

    My router has allocated a dhcp address of 192.168.1.10 to the pfsense WAN I have the pfsense LAN set to 192.168.1.3 which is plugged into the a pc that has an address of 192.168.1.2 I have disabled what I believe to be the blocking rules but according to my system log all traffic is being blocked by default deny rule IPv4.

    Im sure there is some routing rules that I'm missing in order to get the traffic from Wan to 192.168.1.2 but im not sure what should be going where all I want to use it for is to block certain inbound IP address maybe im over complicating things?


  • in any normal setup it is impossible to have the same subnet/iprange on WAN & LAN. routing is impossible between identical/conflicting subnets.

    so basically, you either have to change your WAN subnet or if that is impossible ==> change your LAN subnet to something else


  • Ok so I have set the LAN to 10.1.1.10 on the pfsense and 10.1.1.11 on the pc but I am still unable to route traffic correctly


  • Have you disabled the Block private networks option under Interfaces - WAN?


  • Yes


  • Another option is to eliminate your other router and use pfSense instead.

    If your router is a combination unit and you need to keep the switch ports and/or wireless functions, that's easy to do:  Just disable the DHCP server on your old router and plug one of its LAN ports into the LAN nic on your pfSense machine.  Set up pfSense with your WAN and you're good to go.


  • I don't quite understand surely I should have router –----> pfsense WAN --------> pfsense LAN ------> Server ?

    But do I need some forwarding or rules to be added im in the dark here?


  • Two questions here: can you ping the internal ip of the firewall from your internal network? Let's establish first whether the issue is internal or within the firewall rules. Assuming this works and you can access the web gui, move onto the next step:

    Can you post a screen shot of two particular pages? The first one is found under the Firewall/NAT menu. Select the 'Outbound' tab and post a screenshot of this page. Next, select the Firewall/Rules menu item, click on the 'LAN' tab and post a second screenshot of this page. Finally, click on the 'WAN' tab on the same section (Firewall/Rules) and take a screenshot of this page.


  • I am able to ping the firewall from the server and access the web UI from it to I have added the requested images I have checked my system log which shows activity from the router its the rules/bridging in between





  • The default deny rule is working correctly - the last screenshot you posted shows external addresses trying to hit your external IP, which is correctly blocking the traffic.

    Another test: Try pinging an external address from your LAN PC, such as 8.8.8.8. Do you get a response? Check your default route out on the WAN side (menu item: System/Routing and select the 'gateways' tab. Can you send a screenshot of this page also?

    Last thought: Does your internal PC have the correct DNS settings? Without a valid DNS server in your network settings you won't be able to resolve internet names, which could also be creating the problem you're having.


  • @kurtis318:

    I don't quite understand surely I should have router –----> pfsense WAN --------> pfsense LAN ------> Server ?

    Normally pfSense gets WAN directly, via cable modem, dsl modem, etc., and then you hang everything else (switches, wireless access points, PC clients, … ) off of the pfSense LAN port.  pfSense is the router; if you have another router in front of pfSense, it's best to put it into 'bridge' mode.

    What type of internet connection do you have?  And what is your 'router' (brand & model)?


  • Its a business connection with Zen and the router is a vigor 2710


  • Ok I am able to ping 8.8.8.8 and Im able to view sites


  • I dont want to block the external traffic thats the data I want to recieve

    @muswellhillbilly:

    The default deny rule is working correctly - the last screenshot you posted shows external addresses trying to hit your external IP, which is correctly blocking the traffic.

    Another test: Try pinging an external address from your LAN PC, such as 8.8.8.8. Do you get a response? Check your default route out on the WAN side (menu item: System/Routing and select the 'gateways' tab. Can you send a screenshot of this page also?

    Last thought: Does your internal PC have the correct DNS settings? Without a valid DNS server in your network settings you won't be able to resolve internet names, which could also be creating the problem you're having.


  • Ok, if the ping works, then your firewall/router are both working correctly and the issue is almost certainly DNS. If you're using a Windows PC open a command prompt and type "nslookup www.google.com 8.8.8.8". If you get a non-authoritative answer back then you just have to add 8.8.8.8 as a DNS server in your PC's network settings.

    Alternately, you could set up DHCP on your firewall to assign addresses internally. (Services/DHCP Server + LAN tab). Create a valid internal range and include a public DNS server(s) in the settings. You can try 8.8.8.8 for a start, as it's a public DNS server anyone can use.


  • @kurtis318:

    I dont want to block the external traffic thats the data I want to recieve

    The external traffic being blocked is traffic which is originating from the internet, not your internal network. This is normal behaviour for any firewall - you don't want anyone externally to access your firewall from outside unless you have services that you want external audiences to see, which I don't believe you do. So long as the request originates from inside your LAN, traffic will be allowed back in. It's just the traffic coming unannounced from outside that's being stopped.


  • This server is used for receiving remote CCTV video alarms so I am expecting the majority of traffic to come externally


  • Ok, so you'll need to make sure you know the following information:

    1. Does the traffic from those remote CCTV alarms originate from the remote addresses of the alarms or is the traffic initiated from the internal PC?

    2. If the above answer is 'traffic originates remotely' then what are the external IP addresses of the remote CCTV alarms?

    3. What is the tcp (udp?) port that your internal PC is using to allow connection from those remote alarms? (this has to be visible from the outside)

    If you can pass on the above info, I should be able to tell you what to do to allow access to your PC from those remote sites.


  • Ok this could be tricky

    There are over 200 remote sites each with static external ip's

    tcp ports that need to be open are 25, 8005, 3389, 1025, 1237, 10000, 2000, 1024, 80

    up until recently we blocked all traffic unless recieved on those ports via the router in built software and had filter rules to block ip's that were spamming us I run out of available rules hence the need for pfsense

    Many thanks for your input so far


  • I guess that the front-end router has been setup to port forward all incoming traffic on its public WAN to the pfSense WAN at 192.168.1.10 - since that outside traffic has found its way to pfSense WAN and been blocked and logged.

    Now you need to add port forward/s and rules to allow the traffic you want and forward it to that server on LAN.

    Firewall->Aliases

    1. make an alias with the 200 static public IP addresses that you expect traffic from
    2. Make an alias with the list of destination ports you want to allow traffic to reach
      Firewall->NAT Port Forward
    3. Add a port forward, click the "Advanced" button for Source. Select type "Single host or alias". Start typing the alias name of the 200 addresses - the full name will appear.
    4. Leave source port range "any"
    5. Destination should be WANaddress
    6. Destination port range - use the port alias you made
    7. Redirect target IP - address of the server on LAN
    8. Redirect target port - use the port alias again
    9. Leave "Add associated filter rule" selected at the bottom
      Save it.
      That should redirect all the stuff you want into your server. The associated filter rule should allow it to pass.
      All other traffic on WAN is blocked, so rubbish from unknown places will simply be blocked. You can choose whether to log it or just ignore it.

  • Sorry - had to leave and only just got back to this post. Thanks, Phil - you pretty much summed up what I was going to say. The main brunt of the work will be entering all 200 addresses into the alias you'll need to set up the rule, otherwise the rest of the process should be fairly quick and painless. As Phil says, if your outside router has been set up to forward all incoming traffice regardless of port - or you've set your router to run in bridged mode - then you should be good to go.


  • @muswellhillbilly:

    The main brunt of the work will be entering all 200 addresses into the alias you'll need to set up the rule

    You can copy and paste a list, one IP address per line, straight into the IP address field on the add alias screen.  It will throw a big red error but will also add each IP to a separate entry - no description though.  Just save.

    Of course, you need to have compiled the list to start  :)

  • LAYER 8 Netgate

    You can also load url contents into an alias.

    There is also the bulk import button on the aliases page.

    ![Screen Shot 2014-11-27 at 2.37.20 AM.png](/public/imported_attachments/1/Screen Shot 2014-11-27 at 2.37.20 AM.png)
    ![Screen Shot 2014-11-27 at 2.37.20 AM.png_thumb](/public/imported_attachments/1/Screen Shot 2014-11-27 at 2.37.20 AM.png_thumb)
    ![Screen Shot 2014-11-27 at 2.37.40 AM.png](/public/imported_attachments/1/Screen Shot 2014-11-27 at 2.37.40 AM.png)
    ![Screen Shot 2014-11-27 at 2.37.40 AM.png_thumb](/public/imported_attachments/1/Screen Shot 2014-11-27 at 2.37.40 AM.png_thumb)


  • Ive just had a look at the list and there are a number of host names rather then addresses how would I over come this?

  • Netgate Administrator

    Use the URLs tab instead of IP to import the list as an alias.

    Steve


  • Ok think I have managed to add whats required.

    Is there a rule where I can allow all incoming traffic briefly as I am having a problem with 1 site and I want to prove its not pfsense?


  • @kurtis318:

    Ok think I have managed to add whats required.

    Is there a rule where I can allow all incoming traffic briefly as I am having a problem with 1 site and I want to prove its not pfsense?

    When you say 'all incoming traffic', what do you mean? Do you mean allow all hosts on the internet or all ports from the hosts in your alias list?

    If you are getting success from all the remote points except one, then that will indicate the forwarding is working correctly and the issue lies at the remote end of the one problem point. Before you start opening up your network to the world, I would be inclined to check the logs first. Search for the remote address of the problem site and see what rule is blocking it. This should give you a better idea of the cause of the problem without removing your security entirely. If you can't find an entry for the remote problem site then the issue will almost certainly be some rule or other blocking it at the other end.


  • Yes I mean open all ports and addresses

    Yes I know this is not ideal and im aware of the dangers but I would like to have the option of allowing all addresses and ports through the firewall briefly

  • Netgate Administrator

    Just add a firewall rule to the WAN that allows everything. Any protocol, any source, any destination, any port.
    You can disable it afterwards but leave it there in case you want to enable it again for future testing.

    Steve


  • What Stepehnw10 has said is pretty much it. But rather than give you instructions which would go against every professional bone in my body, maybe it would be better if you described the problem you're having with this one site? Instead of giving you advice which would leave your system open to a potentially devastating attack it would probably be far more constructive to help with the actual issue. Can you give details on what the difficulty is?

    If you'd rather not go into it, then fine. But don't say I didn't warn you.

  • Netgate Administrator

    That's a good point. Whatever you do make sure you remove/disable the rule afterwards.  ;)

    A safer way to test if traffic is arriving from your suspect location would be to run a packet capture on WAN and thgen search it for the address.

    There are also options to disable the firewall completely if you need to.

    Steve


  • Even adding those rules it still appears there is 0 traffic reaching the LAN looking at the firewall log its shows traffic but its all being blocked still with so much down time think im going to have to abandon the use of PFsense as its just not user friendly


  • Before you throw in the towel, why not post a few more screen grabs? If you can take a shot of your NAT forwarding and firewall rules again, particularly the properties for your specific NAT rule you set up on Phil's instruction then that would help. The aliases you've set up for the remote sites and the destination ports would also help. Port forwarding really isn't that difficult under pfSense - certainly much easier than many other firewalls I've worked with.

    I take it that you're unable to receive traffic from ANY of the remote sites? Is this right? Or is it just one or a few sites which aren't working?


  • Think it may be down to the local server maybe I haven't been clear my local server has 2 nics 1 to join my work domain this has its own static IP default gateway and DNS the other is to receive this traffic from the PF sense I have added a static IP of 10.1.1.11 to this nic to connect with the PFsense LAN thats on 10.1.1.10 but I have not added any DNS details is this correct?


  • Ok, that's a little different. What route is the local server using? In order to respond to port forwards via the firewall, the server must have it's default gateway set to the internal NIC of the pfSense.

    You don't mention whether your server is a Windows or Unix machine. Assuming it's Windows, open up a command prompt and type 'route print'. The default gateway should show the pfsense IP as the default gateway out. If not, edit the network settings on the server and set the default gateway to 10.1.1.10 (your pfsense firewall). Then try seeing if your port forwards operate successfully.


  • Ok well its a windows machine what I would trying to achive would be to allow all traffic to get it working then lock it down with all the IP/Hostnames and ports once I have proven it works the problem is the software supports a multitude of different protocols meaning a number of ports both TCP and UDP

    So one last shot of where I am at I have removed all Aliases at this time.




    not to sure what else you would need to see


  • Your screen grab is showing the LAN rules, not the WAN rules. The WAN rules will have the port forwarding rules you created on Phil's instruction.

    In short, can you post screen grabs of the following:

    NAT rules (Firewall/Nat + Port foward tab)
    Firewall rules (Firewall/Rules + WAN tab)
    IP Aliases (Firewall/Aliases + IP tab)
    Port Aliases (Firewall/Aliases + Port tab)


  • Ok - some more thoughts. Can you do a screen grab of the firewall logs (Status/System Logs + Firewall tab)? If anything is trying to access the server it should show up on these logs. Can you initiate an attempted connection from one of your remote sites and take a snapshot of this log page?

    Also, are you running any kind of firewall locally on your server? If you are then this may be what's keeping the traffic from reaching the server.


  • You hit the nail on the head massive oversight on my behalf blocked by the windows firewall disabled that and all of a sudden a mass of traffic and alarms  8)


  • As ever, it's always the simplest things that prove to be the problem. Glad to hear it's sorted. Now please disable that 'allow all' rule before you find your server is being used to peddle cheap Russian viagra.