Prevent some LAN devices from being accessable over L2TP/IPsec
-
Read the language in the documentation again:
Firewall traffic blocked outbound
If the firewall logs show traffic blocked "out" on L2TP, then add a floating firewall rule to work around the block:
Navigate to Firewall > Rules, Floating tab
Click "+" to add a new rule
Set 'Action to Pass
Check Quick
Select L2TP VPN for the Interface
Set Direction to Out
Set Protocol to TCP
Set Source/Destination as needed, or set to any
Advanced Features:
Set TCP Flags to Any flags
Set State Type to Sloppy StateYou should then control what your L2TP VPN clients can connect to with rules on your L2TP VPN tab. if you only want them to get at TCP/UDP 53, TCP/80, and TCP/443 put those pass rules there. Everything else will be blocked as it enters the firewall from the clients. Except that it doesn't work.
I just tested it. The floating rule is exactly as described above. Direction OUT on L2TP VPN verified. It appears the rules on the L2TP VPN tab are ignored. Yes, I cleared states.
I can still SSH to 172.26.0.100 and the source address is the VPN client address 172.29.7.128.




-
Yeah, of course they will get ignored when you tick the "Quick" checkbox on the floating rule.
-
Direction OUT. The SSH connection is coming IN.
So you're saying the wiki is wrong?
https://doc.pfsense.org/index.php/L2TP/IPsec
And the floating rule is for TCP only. I can still ping 172.26.0.100 despite the reject rule.
-
Sigh…
1/ Check what sloppy state does.
2/ Check the Set Source/Destination as needed - why on earth are you setting that as ANY when it obviously is NOT suitable for the intended purpose??? -
Because without it set to ANY reply traffic to sides is blocked outbound. This is with the rule disabled:

 -
The bottom line is rules on the L2TP VPN tab do not work like they work on every other VPN interface in pfSense. They do not filter traffic coming INTO the firewall from VPN clients at the other end of the tunnel.
For instance, with the floating rule disabled I can still ping 172.26.0.100 despite the explicit block rule on L2TP VPN.
-
I am not telling you to disable the rule. I am telling you to "Set Source/Destination as needed". When access to LAN in unwanted, obviously ANY is not proper?!?!?!?!?!?!?!?!?
-
Explain how, with this explicit block rule, L2TP clients can ping 172.26.0.100. The floating rule only applies to TCP traffic anyway so enabled or disabled makes no difference. Let's forget about TCP and concentrate on ICMP.

 -
All rules on LT2P VPN tab disabled
Floating sloppy rule disabled
Only rule on IPsec tab passes UDP 1701 to WAN address
States clearedCan still ping 172.26.0.100 from L2TP clients.
-
Check stuff like pfctl -sr, pfctl -ss and go from there. I have zero desire to dig into the code generating god knows what rules behind the scene, let alone to set up this nonsense here. IPsec alone is flaky like hell here with the strongswan POS, no need to add another level of crap into the mix. There's also this "Disable Auto-added VPN rules" checkbox in System - Advanced - Firewall.
Perhaps start your own thread, debugging your ICMP is really not what's this thread about.
-
Nice hang time on that punt. Maybe before belittling and insulting people next time you take a step back.
-
well thank you for trying to help … maybe best I pay the guys to get help ...