Sanity Check on Rules for NEWB

chris.kemper

Good day Crew, 1st time setting up a real firewall.

Please check these rules and let me know if you see any red flags
I NEED some help on the WIFI Guest rules too please (see bottom)

WAN
Block * RFC 1918 networks * * * * * Block private networks
Block * Reserved/not assigned by IANA * * * * * * Block bogon networks
*Note: protect my LAN from the outside world

LAN
Allow * * * LAN Address 443 80 * * Anti-Lockout Rule
Allow IPv4 * LAN net * * * * none Default allow LAN to any rule
Allow IPv6 * LAN net * * * * none Default allow LAN IPv6 to any rule
*Note: allow all LAN devices full access OUT to WAN and full access to other LAN devices.
*Note: Wirelss AP setup on switch downstream of LAN

WIFI (guest Network)
block IPv4 * * * LAN net * * none block guest wan from local lan
Allow IPv4 * WIFI net * * * * none Default allow LAN to any rule
***Note: I want to allow the guest wifi access to internet/wan, but NO access to LAN.

Something appears to not work in this setup as it does not allow internet connection
Google is no help as it sends me to broken pfsense doc links.**

EMWEE

Post screenshots ita easier for people to help you.

Check your DNS…do a traceroute...check tour firewall logs

chris.kemper

3 firewall tabs attached.

EMWEE

1. Describe your network in more detail.

2. Do a nslookup

3. Do a traceroute

Post results

chris.kemper

Modem
PFSense
-(Firewall, Router, DHCP) (later IPS via SNORT)
-WAN
-LAN (192.168.1.1)
-WLAN (192.168.2.1)
Switch
-DD-WRT Wireless AP (https://forum.pfsense.org/index.php?topic=81014.msg442131#msg442131)

LAN->DD-WRT AP for a mixture of trusted Android, MAC, Linux, and Windows machines -> all use a central unRaid NAS via SMB shares for file storage and access.
WLAN for guest Internet access (personal guests, untrusted household devices such a Sony bluray/netflix terminal -> none of which should have access to the NAS or the other machines on my LAN)

chris.kemper

nslookup and traceroute…
from where and to where would you like these?

Derelict

Typically when a guest network can't surf it's because there are no NAT rules or they can't resolve DNS.

I would run the DNS Resolver on 2.2.2 and explicitly set it in the guest DHCP server and explicitly pass it as the first rule:

Alias wifi_dns_ip 192.168.2.1

Allow IPv4 TCP/UDP WIFI net * wifi_dns_ip 53 * none Pass DNS from guest wlan
block IPv4 * * * LAN net * * none block guest wlan to local lan
block IPv4 * * * This firewall (self) * * none block guest wlan to firewall IPs
Allow IPv4 * WIFI net * * * * none Default allow LAN to any rule

Pass specifically what you need (DHCP is automatically passed when the DHCP server is enabled on an interface)
Block more generally what you don't want them to get to
Pass everything else.

chris.kemper

perfect!

Thanks :)