OPT Interface with no internet access
-
Hi guys, pls give me a hand on this…
I have 3 interfaces on my pfsense box:
WAN
LAN 192.168.10.0
OPT1 192.168.20.0My LAN is able to access internet on WAN ok.
I want just a specific computer on OPT1 to have access to internet: 192.168.20.40
If I set the rule like this:
ID Proto Source Port Destination Port Gateway Queue Schedule Description
IPv4 UDP 192.168.20.40 * WAN Address * * none Get UDP access to 192.168.20.40
IPv4 TCP 192.168.20.40 * WAN Address * * none Get TCP access to 192.168.20.40It does not work. All access from 192.168.20.40 does not reach internet as it gets blocked by pfsense but if I set up rules like this:
ID Proto Source Port Destination Port Gateway Queue Schedule Description
IPv4 UDP 192.168.20.40 * * * * none Get UDP access to 192.168.20.40
IPv4 TCP 192.168.20.40 * * * * none Get TCP access to 192.168.20.40It goes ok.
I'm worried that my OPT1 traffic is being sent to internet via LAN which I assume is a risk. How can I correct that?
Outbound NAT Rules is set to Manual Outbound NAT rule generation (AON - Advanced Outbound NAT)
kind regards
gelcom -
WAN address != internet!!!
-
Ant ideas?
-
What ideas? The second one is correct.
-
Second one allows OPT1 to access LAN (and other interfaces) that I don't want to be accessible from OPT1. I assume there is a way to allow OPT1 to access ONLY internet and not every interface on pfsense…
-
So block it above. Or set the destination to NOT LAN net. Really, read some wiki docs.
https://doc.pfsense.org/index.php/Firewall_Rule_Basics
https://doc.pfsense.org/index.php/Firewall_Rule_Processing_Order -
Let me put it in a different way: Whats makes LAN1 access internet and not OPT1?
If I have the exact same rules on LAN and OPT1 the first one can access internet while the other can't.
-
Let me suggest again to read the docs. And as already said: WAN address is WAN address and nothing else. It is NOT Internet.
-
Pass specific local traffic you want them to be able to access (Like DNS servers)
Block broader local traffic you don't want them to access (Like destinations LAN net and This firewall)
Pass anything else (the internet) -
Isn't there a way to allow just internet access directly?
I understand that all that suggestions you made are based on a 'allow all' then 'deny all except internet traffic' rule. Isn't there a more straightforward way to do this?
-
I understand that all that suggestions you made are based on a 'allow all' then 'deny all except internet traffic' rule.
No, that's not what was suggested. Once you put allow all at the top, everything below will become useless. Really, read the linked docs.
Isn't there a more straightforward way to do this?
Already mentioned above. ::)
-
I understand that all that suggestions you made are based on a 'allow all' then 'deny all except internet traffic' rule.
No, that's not what was suggested. Once you put allow all at the top, everything below will become useless. Really, read the linked docs.
You suggested me to use:
D Proto Source Port Destination Port Gateway Queue Schedule Description
IPv4 UDP 192.168.20.40 * * * * none Get UDP access to 192.168.20.40
IPv4 TCP 192.168.20.40 * * * * none Get TCP access to 192.168.20.40This rule will allow 192.168.20.40 to access:
a) internet - ok
b) all other Ip addresses on 192.168.20.0 network that I don't want
c) all other interfaces I have on pfsense box (LAN, OPT2, OPT3, OPT4, OPT5, …) that I don't want.I understand that I can create aditional rules to disallow these unwanted access ('b' and 'c') but I think that this is a very strange way to make a simple rule to allow a specific IP to get access to internet.
Ps. I read the linked docs.
kind regards
-
c) all other interfaces I have on pfsense box (LAN, OPT2, OPT3, OPT4, OPT5, …) that I don't want.
Goddamn it…
I have 3 interfaces on my pfsense box:
WAN
LAN 192.168.10.0
OPT1 192.168.20.0So, I suggested to put NOT LAN into the destination and be done with it. If you have zillions of interfaces, then make an RFC1918 ranges alias and use it.
b) all other Ip addresses on 192.168.20.0 network that I don't want
This traffic NEVER hits the firewall, so it can never be blocked there.
-
Hi This article seems to help a lot with this reoccurring problem
http://blog.stefcho.eu/pfsense-2-0-rc1-configure-captive-portal-for-guests-with-local-user-management/
-
See my firewall, ZONE alarm that I only want to access the Internet:
fwrule.PNG
Then, the alias RFC 1918 is:
alias.PNG
And, see the rule details whereby we set the destination as anything BUT not internal IP addresses (i.e not the RFC 1918 address space)
rule_detail.PNG