OPT Interface with no internet access

gelcom

Hi guys, pls give me a hand on this…

I have 3 interfaces on my pfsense box:

WAN
LAN 192.168.10.0
OPT1 192.168.20.0

My LAN is able to access internet on WAN ok.

I want just a specific computer on OPT1 to have access to internet: 192.168.20.40

If I set the rule like this:

ID Proto Source Port Destination Port Gateway Queue Schedule Description
IPv4 UDP 192.168.20.40 * WAN Address * * none Get UDP access to 192.168.20.40
IPv4 TCP 192.168.20.40 * WAN Address * * none Get TCP access to 192.168.20.40

It does not work. All access from 192.168.20.40 does not reach internet as it gets blocked by pfsense but if I set up rules like this:

ID Proto Source Port Destination Port Gateway Queue Schedule Description
IPv4 UDP 192.168.20.40 * * * * none Get UDP access to 192.168.20.40
IPv4 TCP 192.168.20.40 * * * * none Get TCP access to 192.168.20.40

It goes ok.

I'm worried that my OPT1 traffic is being sent to internet via LAN which I assume is a risk. How can I correct that?

Outbound NAT Rules is set to Manual Outbound NAT rule generation (AON - Advanced Outbound NAT)

kind regards
gelcom

doktornotor

WAN address != internet!!!

gelcom

Ant ideas?

doktornotor

What ideas? The second one is correct.

gelcom

Second one allows OPT1 to access LAN (and other interfaces) that I don't want to be accessible from OPT1. I assume there is a way to allow OPT1 to access ONLY internet and not every interface on pfsense…

doktornotor

So block it above. Or set the destination to NOT LAN net. Really, read some wiki docs.

https://doc.pfsense.org/index.php/Firewall_Rule_Basics
https://doc.pfsense.org/index.php/Firewall_Rule_Processing_Order

gelcom

Let me put it in a different way: Whats makes LAN1 access internet and not OPT1?

If I have the exact same rules on LAN and OPT1 the first one can access internet while the other can't.

doktornotor

Let me suggest again to read the docs. And as already said: WAN address is WAN address and nothing else. It is NOT Internet.

Derelict

Pass specific local traffic you want them to be able to access (Like DNS servers)
Block broader local traffic you don't want them to access (Like destinations LAN net and This firewall)
Pass anything else (the internet)

gelcom

Isn't there a way to allow just internet access directly?

I understand that all that suggestions you made are based on a 'allow all' then 'deny all except internet traffic' rule. Isn't there a more straightforward way to do this?

doktornotor

@gelcom:

I understand that all that suggestions you made are based on a 'allow all' then 'deny all except internet traffic' rule.

No, that's not what was suggested. Once you put allow all at the top, everything below will become useless. Really, read the linked docs.

@gelcom:

Isn't there a more straightforward way to do this?

Already mentioned above. ::)

gelcom

@doktornotor:

@gelcom:

I understand that all that suggestions you made are based on a 'allow all' then 'deny all except internet traffic' rule.

No, that's not what was suggested. Once you put allow all at the top, everything below will become useless. Really, read the linked docs.

You suggested me to use:

D Proto Source Port Destination Port Gateway Queue Schedule Description
IPv4 UDP 192.168.20.40 * * * * none Get UDP access to 192.168.20.40
IPv4 TCP 192.168.20.40 * * * * none Get TCP access to 192.168.20.40

This rule will allow 192.168.20.40 to access:
a) internet - ok
b) all other Ip addresses on 192.168.20.0 network that I don't want
c) all other interfaces I have on pfsense box (LAN, OPT2, OPT3, OPT4, OPT5, …) that I don't want.

I understand that I can create aditional rules to disallow these unwanted access ('b' and 'c') but I think that this is a very strange way to make a simple rule to allow a specific IP to get access to internet.

Ps. I read the linked docs.

kind regards

doktornotor

@gelcom:

c) all other interfaces I have on pfsense box (LAN, OPT2, OPT3, OPT4, OPT5, …) that I don't want.

Goddamn it…

I have 3 interfaces on my pfsense box:

WAN
LAN 192.168.10.0
OPT1 192.168.20.0

So, I suggested to put NOT LAN into the destination and be done with it. If you have zillions of interfaces, then make an RFC1918 ranges alias and use it.

@gelcom: