Netgate Store

Author Topic: Problem with firewall rule  (Read 168 times)

0 Members and 1 Guest are viewing this topic.

Offline marioja

  • Newbie
  • *
  • Posts: 6
  • Karma: +0/-0
    • View Profile
Problem with firewall rule
« on: February 03, 2018, 08:31:25 pm »
I have a lan interface with the static IPv4 configuration of IPv4 address

I have a lan firewall rule enabled as follow:

block IPV4 TCP source ip any port destination !LAN net any port any gateway no schedule

I am running Squid on pfsense and when I configure Internet Explorer to use the proxy at then pfsense blocks it with this message:

@100(xxxxx) block drop in log quick on xn0 inet proto tcp from to ! flags S/SA label "block internet from specific desktop"

Why is the rule blocking the packets, I am going to the lan interface of pfsense whose ip is within the lan net Is it that pfsense definition of LAN net excludes its own lan ip address?  Is this documented somewhere?  Why does the message not say that.

Any help welcomed.

I had to add an allow rule for pfsense LAN ip ahead of the previous rule for this to work.

Online johnpoz

  • Hero Member
  • *****
  • Posts: 16031
  • Karma: +1531/-221
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: Problem with firewall rule
« Reply #1 on: February 04, 2018, 05:20:36 am »
post up your full lan rules.. Ie screenshot.

And your using transparent proxy or explict?  If you don't want internet on user and your using proxy its best to block in the proxy as well as rules.

- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or
1x SG-2440 2.4.3-RELEASE (work)
1x SG-3100 2.4.3-RELEASE (work)
1x SG-4860 2.4.3-RELEASE-p1 (home)