<![CDATA[Prevent some LAN devices from being accessable over L2TP/IPsec]]>I got all working and I am able to access the Internet and LAN devices through my L2TP/IPsec VPN connection.  Now how do I prevent one of the VPN Client connection to access lets say 192.168.1.3 but still be able to browse the internet through its VPN ?

]]>https://forum.netgate.com/topic/84372/prevent-some-lan-devices-from-being-accessable-over-l2tp-ipsecRSS for NodeMon, 08 Jun 2026 09:23:29 GMTTue, 19 May 2015 20:10:27 GMT60<![CDATA[Reply to Prevent some LAN devices from being accessable over L2TP/IPsec on Sat, 23 May 2015 19:03:59 GMT]]>well thank you for trying to help … maybe best I pay the guys to get help ...

]]>https://forum.netgate.com/post/546284https://forum.netgate.com/post/546284Sat, 23 May 2015 19:03:59 GMT<![CDATA[Reply to Prevent some LAN devices from being accessable over L2TP/IPsec on Sat, 23 May 2015 18:50:58 GMT]]>Nice hang time on that punt. Maybe before belittling and insulting people next time you take a step back.

]]>https://forum.netgate.com/post/546282https://forum.netgate.com/post/546282Sat, 23 May 2015 18:50:58 GMT<![CDATA[Reply to Prevent some LAN devices from being accessable over L2TP/IPsec on Sat, 23 May 2015 18:22:26 GMT]]>Check stuff like pfctl -sr, pfctl -ss and go from there. I have zero desire to dig into the code generating god knows what rules behind the scene, let alone to set up this nonsense here. IPsec alone is flaky like hell here with the strongswan POS, no need to add another level of crap into the mix. There's also this "Disable Auto-added VPN rules" checkbox in System - Advanced - Firewall.

Perhaps start your own thread, debugging your ICMP is really not what's this thread about.

]]>https://forum.netgate.com/post/546278https://forum.netgate.com/post/546278Sat, 23 May 2015 18:22:26 GMT<![CDATA[Reply to Prevent some LAN devices from being accessable over L2TP/IPsec on Sat, 23 May 2015 18:22:10 GMT]]>All rules on LT2P VPN tab disabled
Floating sloppy rule disabled
Only rule on IPsec tab passes UDP 1701 to WAN address
States cleared

Can still ping 172.26.0.100 from L2TP clients.

]]>https://forum.netgate.com/post/546277https://forum.netgate.com/post/546277Sat, 23 May 2015 18:22:10 GMT<![CDATA[Reply to Prevent some LAN devices from being accessable over L2TP/IPsec on Sat, 23 May 2015 18:12:56 GMT]]>Explain how, with this explicit block rule, L2TP clients can ping 172.26.0.100.  The floating rule only applies to TCP traffic anyway so enabled or disabled makes no difference.  Let's forget about TCP and concentrate on ICMP.

![Screen Shot 2015-05-23 at 11.09.45 AM.png](/public/imported_attachments/1/Screen Shot 2015-05-23 at 11.09.45 AM.png)
![Screen Shot 2015-05-23 at 11.09.45 AM.png_thumb](/public/imported_attachments/1/Screen Shot 2015-05-23 at 11.09.45 AM.png_thumb)

]]>https://forum.netgate.com/post/546274https://forum.netgate.com/post/546274Sat, 23 May 2015 18:12:56 GMT<![CDATA[Reply to Prevent some LAN devices from being accessable over L2TP/IPsec on Sat, 23 May 2015 18:05:16 GMT]]>I am not telling you to disable the rule. I am telling you to "Set Source/Destination as needed". When access to LAN in unwanted, obviously ANY is not proper?!?!?!?!?!?!?!?!?

]]>https://forum.netgate.com/post/546273https://forum.netgate.com/post/546273Sat, 23 May 2015 18:05:16 GMT<![CDATA[Reply to Prevent some LAN devices from being accessable over L2TP/IPsec on Sat, 23 May 2015 18:05:07 GMT]]>The bottom line is rules on the L2TP VPN tab do not work like they work on every other VPN interface in pfSense.  They do not filter traffic coming INTO the firewall from VPN clients at the other end of the tunnel.

For instance, with the floating rule disabled I can still ping 172.26.0.100 despite the explicit block rule on L2TP VPN.

]]>https://forum.netgate.com/post/546272https://forum.netgate.com/post/546272Sat, 23 May 2015 18:05:07 GMT<![CDATA[Reply to Prevent some LAN devices from being accessable over L2TP/IPsec on Sat, 23 May 2015 18:01:28 GMT]]>Because without it set to ANY reply traffic to sides is blocked outbound.  This is with the rule disabled:

![Screen Shot 2015-05-23 at 10.57.25 AM.png](/public/imported_attachments/1/Screen Shot 2015-05-23 at 10.57.25 AM.png)
![Screen Shot 2015-05-23 at 10.57.25 AM.png_thumb](/public/imported_attachments/1/Screen Shot 2015-05-23 at 10.57.25 AM.png_thumb)

]]>https://forum.netgate.com/post/546270https://forum.netgate.com/post/546270Sat, 23 May 2015 18:01:28 GMT<![CDATA[Reply to Prevent some LAN devices from being accessable over L2TP/IPsec on Sat, 23 May 2015 17:55:08 GMT]]>Sigh…

1/ Check what sloppy state does.
2/ Check the Set Source/Destination as needed - why on earth are you setting that as ANY when it obviously is NOT suitable for the intended purpose???

]]>https://forum.netgate.com/post/546268https://forum.netgate.com/post/546268Sat, 23 May 2015 17:55:08 GMT<![CDATA[Reply to Prevent some LAN devices from being accessable over L2TP/IPsec on Sat, 23 May 2015 17:52:42 GMT]]>Direction OUT.  The SSH connection is coming IN.

So you're saying the wiki is wrong?

https://doc.pfsense.org/index.php/L2TP/IPsec

And the floating rule is for TCP only.  I can still ping 172.26.0.100 despite the reject rule.

]]>https://forum.netgate.com/post/546267https://forum.netgate.com/post/546267Sat, 23 May 2015 17:52:42 GMT<![CDATA[Reply to Prevent some LAN devices from being accessable over L2TP/IPsec on Sat, 23 May 2015 17:48:42 GMT]]>Yeah, of course they will get ignored when you tick the "Quick" checkbox on the floating rule.

]]>https://forum.netgate.com/post/546264https://forum.netgate.com/post/546264Sat, 23 May 2015 17:48:42 GMT<![CDATA[Reply to Prevent some LAN devices from being accessable over L2TP/IPsec on Sat, 23 May 2015 17:46:20 GMT]]>Read the language in the documentation again:

Firewall traffic blocked outbound

If the firewall logs show traffic blocked "out" on L2TP, then add a floating firewall rule to work around the block:

Navigate to Firewall > Rules, Floating tab
    Click "+" to add a new rule
    Set 'Action to Pass
    Check Quick
    Select L2TP VPN for the Interface
    Set Direction to Out
    Set Protocol to TCP
    Set Source/Destination as needed, or set to any
    Advanced Features:
        Set TCP Flags to Any flags
        Set State Type to Sloppy State

You should then control what your L2TP VPN clients can connect to with rules on your L2TP VPN tab.  if you only want them to get at TCP/UDP 53, TCP/80, and TCP/443 put those pass rules there.  Everything else will be blocked as it enters the firewall from the clients.  Except that it doesn't work.

I just tested it.  The floating rule is exactly as described above.  Direction OUT on L2TP VPN verified.  It appears the rules on the L2TP VPN tab are ignored.  Yes, I cleared states.

I can still SSH to 172.26.0.100 and the source address is the VPN client address 172.29.7.128.

![Screen Shot 2015-05-23 at 10.32.20 AM.png](/public/imported_attachments/1/Screen Shot 2015-05-23 at 10.32.20 AM.png)
![Screen Shot 2015-05-23 at 10.32.20 AM.png_thumb](/public/imported_attachments/1/Screen Shot 2015-05-23 at 10.32.20 AM.png_thumb)
![Screen Shot 2015-05-23 at 10.31.10 AM.png](/public/imported_attachments/1/Screen Shot 2015-05-23 at 10.31.10 AM.png)
![Screen Shot 2015-05-23 at 10.31.10 AM.png_thumb](/public/imported_attachments/1/Screen Shot 2015-05-23 at 10.31.10 AM.png_thumb)
pfSense+L2TP.png
pfSense+L2TP.png_thumb

]]>https://forum.netgate.com/post/546263https://forum.netgate.com/post/546263Sat, 23 May 2015 17:46:20 GMT<![CDATA[Reply to Prevent some LAN devices from being accessable over L2TP/IPsec on Sat, 23 May 2015 17:44:29 GMT]]>@BigApple:

i have no other firewall in place only the pfsense unit. I only have VPN connections coming in… and there is no firewall that I know off...

Sorry, but floating rule with direction OUT will never apply to inbound traffic to the selected interface. You are doing this upside down. You cannot take the wiki rule as is and start restricting ports/IPs accessible on your LAN.

]]>https://forum.netgate.com/post/546261https://forum.netgate.com/post/546261Sat, 23 May 2015 17:44:29 GMT<![CDATA[Reply to Prevent some LAN devices from being accessable over L2TP/IPsec on Sat, 23 May 2015 17:40:22 GMT]]>i have no other firewall in place only the pfsense unit. I only have VPN connections coming in… and there is no firewall that I know off...

]]>https://forum.netgate.com/post/546260https://forum.netgate.com/post/546260Sat, 23 May 2015 17:40:22 GMT<![CDATA[Reply to Prevent some LAN devices from being accessable over L2TP/IPsec on Sat, 23 May 2015 17:21:28 GMT]]>@BigApple:

the rules in the l2tp vpn tab no longer works

Yeah, those will never work… since, this tab is completely WRONG side of the tunnel. You need to move to the other firewall on the other end to block access to LAN. Or really dunno what "LAN network" are you talking about. Perhaps draw some diagram what are you trying to block where.

]]>https://forum.netgate.com/post/546257https://forum.netgate.com/post/546257Sat, 23 May 2015 17:21:28 GMT<![CDATA[Reply to Prevent some LAN devices from being accessable over L2TP/IPsec on Sat, 23 May 2015 17:15:43 GMT]]>my goal is to allow people to browse through the vpn ..but not access the lan network… but to allow browsing I need to turn on the floating rule (TCP any out)

when that is done... I can no longer prevent them from accessing the lan also.... the rules in the l2tp vpn tab no longer works

]]>https://forum.netgate.com/post/546256https://forum.netgate.com/post/546256Sat, 23 May 2015 17:15:43 GMT<![CDATA[Reply to Prevent some LAN devices from being accessable over L2TP/IPsec on Sat, 23 May 2015 17:07:04 GMT]]>And why are those other rules floating? Leave the wiki one as floating direction out and put the rest where it belongs to restrict traffic. I really don't understand how we all of a sudden got to the "to allow browsing only ". You stated the goal is to "prevent some LAN devices from being accessable over L2TP/IPsec". This is the exact opposite direction.

]]>https://forum.netgate.com/post/546255https://forum.netgate.com/post/546255Sat, 23 May 2015 17:07:04 GMT<![CDATA[Reply to Prevent some LAN devices from being accessable over L2TP/IPsec on Sat, 23 May 2015 16:50:28 GMT]]>I used out only but when I used ports 53, 80, 443 to allow browsing only on the floating rule it does not work (see sample)

the floating rule only allows internet when any is selected …(see below)

]]>https://forum.netgate.com/post/546254https://forum.netgate.com/post/546254Sat, 23 May 2015 16:50:28 GMT<![CDATA[Reply to Prevent some LAN devices from being accessable over L2TP/IPsec on Sat, 23 May 2015 16:29:08 GMT]]>Did you configure this as direction Out and not any? Plus, what's preventing you from using the Source/Destination to restrict this to what you want only?

]]>https://forum.netgate.com/post/546250https://forum.netgate.com/post/546250Sat, 23 May 2015 16:29:08 GMT<![CDATA[Reply to Prevent some LAN devices from being accessable over L2TP/IPsec on Sat, 23 May 2015 15:13:25 GMT]]>neither do i .. I just know I can no longer block access to the lan

]]>https://forum.netgate.com/post/546237https://forum.netgate.com/post/546237Sat, 23 May 2015 15:13:25 GMT<![CDATA[Reply to Prevent some LAN devices from being accessable over L2TP/IPsec on Sat, 23 May 2015 14:37:50 GMT]]>@BigApple:

Once the floating rule is in place … you can browse and you can access the entire network. In general that is a good idea... but I need to be able to block some machines from being accessible through the VPN connection.

Looking at the wiki, that rule is direction Out. Not really sure how's that affecting you.

]]>https://forum.netgate.com/post/546232https://forum.netgate.com/post/546232Sat, 23 May 2015 14:37:50 GMT<![CDATA[Reply to Prevent some LAN devices from being accessable over L2TP/IPsec on Sat, 23 May 2015 11:55:14 GMT]]>Thank you  and yes that is certainly no problem at all. The problem is that after doing so I no longer have the ability to block access to certain LAN devices.
Once the floating rule is in place … you can browse and you can access the entire network. In general that is a good idea... but I need to be able to block some machines from being accessible through the VPN connection.

]]>https://forum.netgate.com/post/546204https://forum.netgate.com/post/546204Sat, 23 May 2015 11:55:14 GMT<![CDATA[Reply to Prevent some LAN devices from being accessable over L2TP/IPsec on Sat, 23 May 2015 01:32:02 GMT]]>Sorry.  I haven't revisited it.  It says right there in the wiki that a floating pass rule on L2TP VPN interface might be necessary.

]]>https://forum.netgate.com/post/546167https://forum.netgate.com/post/546167Sat, 23 May 2015 01:32:02 GMT<![CDATA[Reply to Prevent some LAN devices from being accessable over L2TP/IPsec on Sat, 23 May 2015 00:48:04 GMT]]>@BigApple:

thank you very much …  i thought I am going to loose my last few hair that I have left. good to know its not just me seeing having a problem there

any news yet ?  I can not block lan access unless I turn of the floating rule.  and if I do so I lose also internet access.

]]>https://forum.netgate.com/post/546161https://forum.netgate.com/post/546161Sat, 23 May 2015 00:48:04 GMT