Blocking Traffic
-
Hi All,
Can I block the incoming traffic after from Wan? For example:
Client (ICMP: echo request) = > Wan => (Wan Rule: Pass Any Any) PFsense => Server
Client <= Wan <= PFsense (Lan Rule: Block Any Any) <= (ICMP: echo reply) Server
I set the Lan block anything from my server. Client still can receive my echo reply. I want to record who ping my server, but I don't want the client receive my server echo reply. I don't want to set server to block it. Can I do it in PFsense? Please advise.
Thanks,
Tom -
First of all, you don't want to pass all traffic through WAN. You put firewall rules on the interfaces where the traffic is incoming. SO to block stuff from entering your network, you put the rule on WAN, not LAN. Right now your network is wide open to the outside world.
You can create a specific rule on WAN to block all ICMP and then set the rule to log, and place the rule at the top so it gets triggered before the Default Deny rule. All ICMP will be blocked and all ping attempts will be logged.
-
Hi,
Thank you for your suggestion.
But I don't really want to block it in Wan Port, can I block it in Lan port?
Thanks
-
For the most part, you can only block incoming traffic. If you want to block traffic on the LAN interface, you'll be limited to blocking traffic that originates on the LAN.
-
The echo reply is allowed back because pfSense is a stateful firewall. When the echo request goes out, a state is created for the source-destination IP+protocol… combination. When the echo reply packet is received back on WAN it is allowed in and through to the client because it matches an existing state.
This is exactly the same as web browsing... - the page content coming back from an external web site is allowed in on WAN because the client request from the browser has first gone out to the web server and a state has thus been created. -
But I don't really want to block it in Wan Port, can I block it in Lan port?
No. That's not how it works. If you want to block pings on WAN then you need to put your rule on WAN. Blocking ping on WAN from LAN is kind of pointless. -
so you have a any any rule on wan? Yeah that is not good…
"Wan => (Wan Rule: Pass Any Any) PFsense => Server"
If this is what you want
"I want to record who ping my server"Why don't you just setup a wan block ping with logging? Why wold you want to send it all they way to the server, just to block the servers reply?
