Firewall rule questions Block LAN to WAN but allow VPN traffic to pass
-
Hi Guys,
I think I need some clarification here, I would like to block all traffic to go directly through my WAN interface reason for that is I'm using pfsense to connect to a VPN in Switzerland but in case this connection breaks for some reason I don't want pfsense to failover to my normal WAN interface I've set the VPN gateway to default and created a floating rule as follows:
block -> LAN interface -> WAN interface from any to any for IPv4 and IPv6 as quick match
Screenshots attached
Did I do it right to get it work or should I do it different?
Thank you
![Screen Shot 2015-05-23 at 6.46.59 pm.png](/public/imported_attachments/1/Screen Shot 2015-05-23 at 6.46.59 pm.png)
![Screen Shot 2015-05-23 at 6.46.59 pm.png_thumb](/public/imported_attachments/1/Screen Shot 2015-05-23 at 6.46.59 pm.png_thumb)
![Screen Shot 2015-05-23 at 6.46.47 pm.png](/public/imported_attachments/1/Screen Shot 2015-05-23 at 6.46.47 pm.png)
![Screen Shot 2015-05-23 at 6.46.47 pm.png_thumb](/public/imported_attachments/1/Screen Shot 2015-05-23 at 6.46.47 pm.png_thumb)
![Screen Shot 2015-05-23 at 6.47.44 pm.png](/public/imported_attachments/1/Screen Shot 2015-05-23 at 6.47.44 pm.png)
![Screen Shot 2015-05-23 at 6.47.44 pm.png_thumb](/public/imported_attachments/1/Screen Shot 2015-05-23 at 6.47.44 pm.png_thumb) -
No. WAN net is not the internet. You want any.
I do what you're trying to do like this: https://forum.pfsense.org/index.php?topic=84463.msg463226#msg463226
If you're sending the traffic to the VPN, mark it. Then block all traffic with that mark from being sent out WAN.
-
Ok thank you did that and I think it works.
But one more question what would happen if I specify my VPN as gateway on my pass all rule ? Would this achieve the same in case this gateway goes down all other traffic would be blocked/dropped? Just a question to clarify what the extra gateway option is for
Thank you
-
https://doc.pfsense.org/index.php/What_is_policy_routing