Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Firewall Blocking

    Firewalling
    3
    10
    1917
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • W
      waya01 last edited by

      Hi,

      I have setup a captive portal for our BYOD network which works and people can browse the internet with no problem.  But they are unable to upload files to anywhere and if I do a speedtest download is fine but upload is 0Mbps.

      I have looked at the firewall and I can see it's blocking a lot under the default deny rule which does coincide with when I'm testing upload.  But I have tried using the add easy rule pass traffic link to allow the traffic and I have added in allow everything rules onto all interfaces on the firewall, but no matter what I add it still is ignoring the rules and blocking it under default deny rule.

      Help!

      Thanks,

      Andy

      1 Reply Last reply Reply Quote 0
      • H
        Harvy66 last edited by

        What are your firewall rules for your interfaces?

        1 Reply Last reply Reply Quote 0
        • W
          waya01 last edited by

          Hi,

          Thanks for your reply.

          I've copied the table for the rules which are all Pass rules.  As you can see this should allow all traffic through.

          ID Proto Source Port Destination Port Gateway Queue Schedule Description

              • LAN Address 80 * *  Anti-Lockout Rule

          IPv4 *  *  *  *  *  *  none

          IPv4 *  LAN net  *  *  *  GW_WAN  none      Default allow LAN to any rule

          IPv6 *  LAN net  *  *  *  *  none      Default allow LAN IPv6 to any rule

          IPv4 TCP  10.50.1.52  *  192.168.10.6  9191  *  none      Easy Rule: Passed from Firewall Log View

          IPv4 TCP  10.50.1.52  *  192.168.10.6  9191  *  none      Easy Rule: Passed from Firewall Log View

          But there is a lot being blocked under the LAN default deny rule.

          Thanks,

          Andy

          1 Reply Last reply Reply Quote 0
          • W
            waya01 last edited by

            I have just gone into System - Advanced - Firewall / NAT, and disabled the firewall.  Uploads are now working, so it is definitely the firewall causing the issue.  But I want the firewall enabled so can control access to certain IP Ranges, etc.

            1 Reply Last reply Reply Quote 0
            • johnpoz
              johnpoz LAYER 8 Global Moderator last edited by

              And what are you rules on the captive portal?

              Your ipv4 rules after your any any rule on the top are all pointless and would never fire anyway.. Since the first rule would allow the traffic.

              Curious what would be uploading to 9191, that sure would not be speedtest.

              1 Reply Last reply Reply Quote 0
              • W
                waya01 last edited by

                The captive portal is just setup for vouchers, this is still working.

                That's what I thought but even the top rule which should allow all traffic is being ignored as it's still being blocked by the default deny all traffic rule.  Although the users can browse the internet so requests, etc. are getting through.  The port 9191 is our papercut server which I am attempting to upload a document through webprint.  I can view the page and get through all the parts but as soon as it attempts to upload the file it fails.

                Now I have disabled the firewall, the captive portal/vouchers are still working but uploads are working.  I would like the firewall on though so I can block access to certain ports and IP Addresses.

                Thanks

                Andy

                1 Reply Last reply Reply Quote 0
                • W
                  waya01 last edited by

                  Oh and the uploads to papercut also work without the firewall.  So just need to figure out why the firewall is blocking uploads even with the rules in place.

                  1 Reply Last reply Reply Quote 0
                  • johnpoz
                    johnpoz LAYER 8 Global Moderator last edited by

                    Where is that papercut "192.168.10.6"  That is another rfc1918 address, is it another lan segment, vlan - is it on the wan of your pfsense?  is it a downstream network?  What is this upload method ftp?  Webprint - is that just an http upload?

                    If wan your double nat, do you have the block private networks enabled?

                    Can we see these blocks in the firewall - screenshot is easier to read.. Sure its just not out of state being blocked..  Or is actually a syn that is being blocked?

                    1 Reply Last reply Reply Quote 0
                    • W
                      waya01 last edited by

                      Yes the papercut server is 192.168.10.6.  It is a separate VLAN.  This way I can set some internal servers to be accessed direct, and using ACLs between VLANs (not yet setup) and the firewall on pfsense control which servers are accessible direct.  I also need it to go through the same firewall uplink as other traffic so it passes over our Lightspeed bridge so the web filter still filters the traffic.

                      I have made sure the block private networks is disabled.  I have taken a screenshot of the blocks which is attached


                      1 Reply Last reply Reply Quote 0
                      • johnpoz
                        johnpoz LAYER 8 Global Moderator last edited by

                        Those are all out of state blocks.. see the Ack vs Syn

                        Do you have some sort of routing issue where 10.50.1.52 would send its syn one path, and get syn,ack back a different way so would send ack to different path?

                        I don't see your papercut in there anywhere.  Do you have multiple wan paths?

                        A diagram of your connections could be very helpful in working out the issue your having.

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post

                        Products

                        • Platform Overview
                        • TNSR
                        • pfSense Plus
                        • Appliances

                        Services

                        • Training
                        • Professional Services

                        Support

                        • Subscription Plans
                        • Contact Support
                        • Product Lifecycle
                        • Documentation

                        News

                        • Media Coverage
                        • Press
                        • Events

                        Resources

                        • Blog
                        • FAQ
                        • Find a Partner
                        • Resource Library
                        • Security Information

                        Company

                        • About Us
                        • Careers
                        • Partners
                        • Contact Us
                        • Legal
                        Our Mission

                        We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

                        Subscribe to our Newsletter

                        Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

                        © 2021 Rubicon Communications, LLC | Privacy Policy