Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Firewall rule questions Block LAN to WAN but allow VPN traffic to pass

    Scheduled Pinned Locked Moved
    Firewalling
    2
    4
    863
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      nils92
      last edited by

      Hi Guys,

      I think I need some clarification here, I would like to block all traffic to go directly through my WAN interface reason for that is I'm using pfsense to connect to a VPN in Switzerland but in case this connection breaks for some reason I don't want pfsense to failover to my normal WAN interface I've set the VPN gateway to default and created a floating rule as follows:

      block -> LAN interface -> WAN interface from any to any for IPv4 and IPv6 as quick match

      Screenshots attached

      Did I do it right to get it work or should I do it different?

      Thank you
      ![Screen Shot 2015-05-23 at 6.46.59 pm.png](/public/imported_attachments/1/Screen Shot 2015-05-23 at 6.46.59 pm.png)
      ![Screen Shot 2015-05-23 at 6.46.59 pm.png_thumb](/public/imported_attachments/1/Screen Shot 2015-05-23 at 6.46.59 pm.png_thumb)
      ![Screen Shot 2015-05-23 at 6.46.47 pm.png](/public/imported_attachments/1/Screen Shot 2015-05-23 at 6.46.47 pm.png)
      ![Screen Shot 2015-05-23 at 6.46.47 pm.png_thumb](/public/imported_attachments/1/Screen Shot 2015-05-23 at 6.46.47 pm.png_thumb)
      ![Screen Shot 2015-05-23 at 6.47.44 pm.png](/public/imported_attachments/1/Screen Shot 2015-05-23 at 6.47.44 pm.png)
      ![Screen Shot 2015-05-23 at 6.47.44 pm.png_thumb](/public/imported_attachments/1/Screen Shot 2015-05-23 at 6.47.44 pm.png_thumb)

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        No.  WAN net is not the internet.  You want any.

        I do what you're trying to do like this: https://forum.pfsense.org/index.php?topic=84463.msg463226#msg463226

        If you're sending the traffic to the VPN, mark it.  Then block all traffic with that mark from being sent out WAN.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • N
          nils92
          last edited by

          Ok thank you did that and I think it works.

          But one more question what would happen if I specify my VPN as gateway on my pass all rule ? Would this achieve the same in case this gateway goes down all other traffic would be blocked/dropped? Just a question to clarify what the extra gateway option is for

          Thank you

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            https://doc.pfsense.org/index.php/What_is_policy_routing

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • First post
              Last post