Firewall Blocking

waya01 · Jan 29, 2015, 11:56 AM

Hi,

I have setup a captive portal for our BYOD network which works and people can browse the internet with no problem. But they are unable to upload files to anywhere and if I do a speedtest download is fine but upload is 0Mbps.

I have looked at the firewall and I can see it's blocking a lot under the default deny rule which does coincide with when I'm testing upload. But I have tried using the add easy rule pass traffic link to allow the traffic and I have added in allow everything rules onto all interfaces on the firewall, but no matter what I add it still is ignoring the rules and blocking it under default deny rule.

Help!

Thanks,

Andy

Harvy66 · Jan 29, 2015, 1:21 PM

What are your firewall rules for your interfaces?

waya01 · Jan 29, 2015, 2:13 PM

Hi,

Thanks for your reply.

I've copied the table for the rules which are all Pass rules. As you can see this should allow all traffic through.

ID Proto Source Port Destination Port Gateway Queue Schedule Description

- - LAN Address 80 * * Anti-Lockout Rule

IPv4 * * * * * * none

IPv4 * LAN net * * * GW_WAN none Default allow LAN to any rule

IPv6 * LAN net * * * * none Default allow LAN IPv6 to any rule

IPv4 TCP 10.50.1.52 * 192.168.10.6 9191 * none Easy Rule: Passed from Firewall Log View

But there is a lot being blocked under the LAN default deny rule.

Thanks,

Andy

waya01 · Jan 29, 2015, 2:30 PM

I have just gone into System - Advanced - Firewall / NAT, and disabled the firewall. Uploads are now working, so it is definitely the firewall causing the issue. But I want the firewall enabled so can control access to certain IP Ranges, etc.

johnpoz · Jan 29, 2015, 2:44 PM

And what are you rules on the captive portal?

Your ipv4 rules after your any any rule on the top are all pointless and would never fire anyway.. Since the first rule would allow the traffic.

Curious what would be uploading to 9191, that sure would not be speedtest.

waya01 · Jan 29, 2015, 3:35 PM

The captive portal is just setup for vouchers, this is still working.

That's what I thought but even the top rule which should allow all traffic is being ignored as it's still being blocked by the default deny all traffic rule. Although the users can browse the internet so requests, etc. are getting through. The port 9191 is our papercut server which I am attempting to upload a document through webprint. I can view the page and get through all the parts but as soon as it attempts to upload the file it fails.

Now I have disabled the firewall, the captive portal/vouchers are still working but uploads are working. I would like the firewall on though so I can block access to certain ports and IP Addresses.

Thanks

Andy

waya01 · Jan 29, 2015, 3:40 PM

Oh and the uploads to papercut also work without the firewall. So just need to figure out why the firewall is blocking uploads even with the rules in place.

johnpoz · Jan 29, 2015, 4:01 PM

Where is that papercut "192.168.10.6" That is another rfc1918 address, is it another lan segment, vlan - is it on the wan of your pfsense? is it a downstream network? What is this upload method ftp? Webprint - is that just an http upload?

If wan your double nat, do you have the block private networks enabled?

Can we see these blocks in the firewall - screenshot is easier to read.. Sure its just not out of state being blocked.. Or is actually a syn that is being blocked?

waya01 · Jan 30, 2015, 2:12 PM

Yes the papercut server is 192.168.10.6. It is a separate VLAN. This way I can set some internal servers to be accessed direct, and using ACLs between VLANs (not yet setup) and the firewall on pfsense control which servers are accessible direct. I also need it to go through the same firewall uplink as other traffic so it passes over our Lightspeed bridge so the web filter still filters the traffic.

I have made sure the block private networks is disabled. I have taken a screenshot of the blocks which is attached

johnpoz · Jan 30, 2015, 2:46 PM

Those are all out of state blocks.. see the Ack vs Syn

Do you have some sort of routing issue where 10.50.1.52 would send its syn one path, and get syn,ack back a different way so would send ack to different path?

I don't see your papercut in there anywhere. Do you have multiple wan paths?

A diagram of your connections could be very helpful in working out the issue your having.