Blocks any traffic in the FORWARD chain

n.vakili

Hi every body

I want to blocks any traffic from the forward chain
like this 'iptables -P FORWARD DROP'

but I don't how to do this in pfsense
thanks

muswellhillbilly

By default PFS drops all traffic from the WAN side and allows all traffic from the LAN side. You don't say from where or how you want to drop packets, so I assume this is how you need it to be. Otherwise, you can remove the Default LAN -> any rule and put your own custom rules in place if that's what you mean.

n.vakili

thanks dear

it's mean traffic that comes from my (V)LANs and is not destined for the router (pfsense) itself will NOT be forwarded

traffic that comes from outside networks and is destined for machines on your (V)LANs will NOT be forwarded (even when NATting)
to 'get through' the router now, users have to enable the proxy settings in their OS / browsers (default port 3128)

cmb

There are no concepts of chains in pf. Just configure your firewall rules accordingly to allow traffic to the proxy and block everything else.

n.vakili

thanks

how can I do this to allow traffic to the proxy and block everything else.

can you please give me a tutorial

KOM

Just add a rule above your Allow All rule on your LAN and VLANs that blocks access to ports 80/443. You can either use two rules (one for each port), or create a port alias for 80 & 443 then create one rule that blocks access to that alias as the destination port.

n.vakili

thanks dear

Can you send me a screenshot or a complete tutorial because I am not familiar very well with pfsese

thanks

Derelict

SMH dear

n.vakili

'iptables -P FORWARD DROP'

I want to disable FORWARD Chain in Pfsense

thanks

muswellhillbilly

Here you go, darling:
https://doc.pfsense.org/index.php/Example_basic_configuration

KOM

Everyone: The use of terms of endearment are common with speakers from the Middle East. While they may appears out of place to us in a technical discussion, please don't mock them for it.

N.Vakili: See the diagram where I have created an alias called Web_Ports that holds 80 & 443. The rule is placed above the Default allow LAN to any rule. The effect of this rule is to block all access to the standard web ports.

LANRule.png_thumb

muswellhillbilly

@KOM:

Everyone: The use of terms of endearment are common with speakers from the Middle East. While they may appears out of place to us in a technical discussion, please don't mock them for it.

Noted. Though in truth I thought this was more a Google-translate error and was really gently mocking what I thought was a technical mishap on their part.