pfSense Gold Subscription

Author Topic: vlans being blocked  (Read 272 times)

0 Members and 1 Guest are viewing this topic.

Offline cmpufxr

  • Newbie
  • *
  • Posts: 14
  • Karma: +0/-0
    • View Profile
vlans being blocked
« on: August 29, 2017, 05:09:42 pm »
Awesome package!! I have been using it for awhile now and I almost know how to use it.

I have some lists that I need to block on the lan(no vlan), dom (vlan) web(vlan) but I do not want to block gam(vlan) and vpn(vlan).

the lan is on its own 10gbe nic while the vlan all reside on another 10gbe nic. I do not have any more pci slots to add more nics.

The issue is that when I enable pfblockerng and dnsbl on the dom and web vlan, it also blocks the gam and vpn vlans even though I have not selected them. I have temporary changed the dns for the gam and vpn vlans to a dns server different than the what the dns resolver uses to prevent this.

I was under the understanding that the option of selecting the "DNSBL Firewall Rule" would allow blocking on some subnets but not others.

also, I have had this setup for awhile on 1gbe nic without any issues, it is only when I upgraded to 10gbe and rebuilt the firewall that I have had this issue. before everything worked fine.
« Last Edit: August 29, 2017, 05:16:48 pm by cmpufxr »

Offline BBcan177

  • Moderator
  • Hero Member
  • *****
  • Posts: 2554
  • Karma: +797/-5
    • View Profile
    • Click for Support
Re: vlans being blocked
« Reply #1 on: September 12, 2017, 05:34:32 am »
The only way to bypass DNSBL is to define a different DNS server for those specific lan segments.

The DNSBL permit rule is used to allow those other lan segments to talk to the DNSBL webserver. Otherwise, those other lan segments could timeout waiting for the DNSBL webserver to reply.
"Experience is something you don't get until just after you need it."

 | http://pfblockerng.com | Twitter @BBcan177  | #pfBlockerNG |

Offline cmpufxr

  • Newbie
  • *
  • Posts: 14
  • Karma: +0/-0
    • View Profile
Re: vlans being blocked
« Reply #2 on: November 18, 2017, 07:13:49 am »
OK, I got it... thanks for clarifying that for me.