pfSense Support Subscription

Author Topic: FIREWALL RULES FOR TRAFFIC BETWEEN INTERFACES  (Read 3594 times)

0 Members and 1 Guest are viewing this topic.

Offline Summer

  • Jr. Member
  • **
  • Posts: 43
  • Karma: +0/-0
    • View Profile
FIREWALL RULES FOR TRAFFIC BETWEEN INTERFACES
« on: June 27, 2012, 08:17:47 am »
Hi, please explain me how to allow traffic between different interfaces.
I have: WAN,
            LAN:192.168.1.11 (but there are also other networks behind 192.168.11.0/24 and 192.168.21.0/24),
            OPT2: 192.168.2.11 (but there are also other networks behind 192.168.11.0/24 and 192.168.21.0/24), .
Need to access OPT2 networks from LAN but only from some host.
I've added a firewall rule both on LAN and OPT2 that says (this one should make all trafic possible right?):
*    *    *    *    *    *    none     
but can't reach the hosts behind the other interface, the interface IP ping, but host behind it no.
Thanks in advance for advices. BR.

Offline podilarius

  • Hero Member
  • *****
  • Posts: 1768
  • Karma: +0/-0
    • View Profile
Re: FIREWALL RULES FOR TRAFFIC BETWEEN INTERFACES
« Reply #1 on: June 27, 2012, 09:43:07 am »
Not sure exactly what issue you are refering to. Are you not able to connect to the 11.0 and the 21.0 networks? If that is the case, you are going to have to create a route so that the firewall will know where to route that data.
The rules you have specified should allow access between the 1.0 and 2.0 networks as well as the 11.0 and 21.0 networks once you have the route taken care of.

Offline stephenw10

  • Hero Member
  • *****
  • Posts: 8167
  • Karma: +8/-0
    • View Profile
Re: FIREWALL RULES FOR TRAFFIC BETWEEN INTERFACES
« Reply #2 on: June 27, 2012, 10:05:53 am »
You can't have routes to 192.168.11.0/24 and 192.168.21.0/24 via both interfaces.

Steve

Offline podilarius

  • Hero Member
  • *****
  • Posts: 1768
  • Karma: +0/-0
    • View Profile
Re: FIREWALL RULES FOR TRAFFIC BETWEEN INTERFACES
« Reply #3 on: June 27, 2012, 11:05:04 am »
No, but you can have it via one and the other will route threw it. Or, you can have DHCP push the route though I have only done that with a Windows DHCP server.

Offline Summer

  • Jr. Member
  • **
  • Posts: 43
  • Karma: +0/-0
    • View Profile
Re: FIREWALL RULES FOR TRAFFIC BETWEEN INTERFACES
« Reply #4 on: July 03, 2012, 08:29:18 am »
Thanks for your replies, I've made :
a new gateway on OPT2 interface with ip 192.168.2.11
a new route to network:                 gw:           interface:
192.168.2.0/24    OPT2GW - 192.168.2.11    OPT2

Now I can almost ping the devices on the OPT2 interface
I say almost because got :
From x.x.x.x. icmp_seq=1 Time to live exceeded

are these steps and results corrects?

Offline stephenw10

  • Hero Member
  • *****
  • Posts: 8167
  • Karma: +8/-0
    • View Profile
Re: FIREWALL RULES FOR TRAFFIC BETWEEN INTERFACES
« Reply #5 on: July 03, 2012, 08:40:01 am »
Err...no, I don't think so.
Could you give us a diagram of your network? I'm confused as to quite how you have things connected from your description.

Steve

Offline Summer

  • Jr. Member
  • **
  • Posts: 43
  • Karma: +0/-0
    • View Profile
Re: FIREWALL RULES FOR TRAFFIC BETWEEN INTERFACES
« Reply #6 on: July 03, 2012, 09:18:33 am »
I need to know if it is possible to make the devices with ip address between the same network  but different interface, to comminicate each other (blue line).
But not the 10.x devices that should not go out from the LAN interface



Let me know if it isn't clear.
« Last Edit: July 03, 2012, 10:09:34 am by Summer »

Offline podilarius

  • Hero Member
  • *****
  • Posts: 1768
  • Karma: +0/-0
    • View Profile
Re: FIREWALL RULES FOR TRAFFIC BETWEEN INTERFACES
« Reply #7 on: July 03, 2012, 10:25:27 am »
So those are just extra subnets? If so, you are going to have to create an IP Alais in each subnet before the pfSense machine will route properly. If you have a router on each side handling those subnets, then you are going to have to add that route in the pfSense firewall before it routes correctly. how are you normally getting traffic between subnets?

Offline stephenw10

  • Hero Member
  • *****
  • Posts: 8167
  • Karma: +8/-0
    • View Profile
Re: FIREWALL RULES FOR TRAFFIC BETWEEN INTERFACES
« Reply #8 on: July 03, 2012, 10:48:44 am »
Even if they are just extra subnets you still can't do that because you have the same subnet behind each interface. For example: if a packet comes into pfSense addressed to 192.168.2.10 which interface should it be routed to? There is no way to know.

The only way I can see to do this, keeping the subnets as labelled, would be with VLANs and bridging but that's a fairly complex setup.

It would be much easier to, for example, change the subnets behind LAN to .11.X and .12.X.
Is there some reason you can't do that?

Steve

Offline podilarius

  • Hero Member
  • *****
  • Posts: 1768
  • Karma: +0/-0
    • View Profile
Re: FIREWALL RULES FOR TRAFFIC BETWEEN INTERFACES
« Reply #9 on: July 03, 2012, 11:27:12 am »
If it is the same, just create one IP alias in say 2.x one LAN and 1.x on opt (for some balancing) and that should be able to route how you need. If they are separate, then stephenw10 is correct and I would change the subnets to 11.x 12.x on LAN and 13.x and 14.x on the OPT with IP aliases all around.

Offline Summer

  • Jr. Member
  • **
  • Posts: 43
  • Karma: +0/-0
    • View Profile
Re: FIREWALL RULES FOR TRAFFIC BETWEEN INTERFACES
« Reply #10 on: July 04, 2012, 08:59:14 am »
thanks for your explanation, I'm trying to keep it simple, avoiding VLANs (for now, someday who knows...).

I've tried with iP alias from Virtual IP like this:

192.168.2.1/24    [IP Alias]  on LAN
192.168.1.1/24    [IP Alias]  on OPT2
I can ping them, then I've added them as gateways and this is the route:
192.168.2.0/24    gw1 - 192.168.1.1    OPT2
but maybe I lost something...
if ping 192.168.2.12 that is on OPT2 don't get the answer

I can change the networks on the LAN but how can I route 12.x with 13.x?


Offline Summer

  • Jr. Member
  • **
  • Posts: 43
  • Karma: +0/-0
    • View Profile
Re: FIREWALL RULES FOR TRAFFIC BETWEEN INTERFACES
« Reply #11 on: July 04, 2012, 09:14:57 am »
ok I'm alittle confused,



to simplify all, if for example I want to reach the networks on the other interface from the 10.x and get their reply, but don't allow the traffic coming from the opt2 to lan  interface if isn't a reply from a request from the LAN, could it be possile?

Offline stephenw10

  • Hero Member
  • *****
  • Posts: 8167
  • Karma: +8/-0
    • View Profile
Re: FIREWALL RULES FOR TRAFFIC BETWEEN INTERFACES
« Reply #12 on: July 04, 2012, 11:09:34 am »
Yes certainly.
Just put a firewall rule on LAN to allow traffic with source 192.168.10.X and destination 192.168.1-2.X.
This would already be included in the default 'LAN to any' rule if you haven't changed it.
As long as you don't put a rule on OPT2 to specifically allow traffic in the other direction it will be blocked.

Your Virtual IP should be 192.168.2.0/24 on OPT2.

Are you using static IPs on the clients on OPT2?

Steve

Offline Summer

  • Jr. Member
  • **
  • Posts: 43
  • Karma: +0/-0
    • View Profile
Re: FIREWALL RULES FOR TRAFFIC BETWEEN INTERFACES
« Reply #13 on: July 16, 2012, 07:47:40 am »
Thanks for your help, but it seems I miss something.
Tried to ping a device on opt2 from lan but still got a message of host unreachable, I've checked with wire shark what happen:
as source I see the MAC of opt2 , destination broadcast, protocol ARP, info who has 192.168.2.33 ? tell 192.168.10.10
why broadcast message are sended on lan from opt2?

Offline podilarius

  • Hero Member
  • *****
  • Posts: 1768
  • Karma: +0/-0
    • View Profile
Re: FIREWALL RULES FOR TRAFFIC BETWEEN INTERFACES
« Reply #14 on: July 16, 2012, 09:38:49 am »
Summer ... I would put an allow all rule on all interfaces until you made sure that your routing is correct. Once you know routing is working correct, then you can go back and restrict traffic how you need to. Also,

on pfSense
LAN : 192.168.10.3/24
OPT1: 192.168.1.3/24
IP Alias on OPT1: 192.168.2.3/24

Computers on LAN of pfSense use the gateway of 192.168.10.3.
Computers on the OPT1 use either 192.168.1.3 or 192.168.2.3 as their gateway depending on the subnet they are on.

If you have a different gateway for .1.0/24 and .2.0/24, you are going to have to create a route in that router to poing .10.0/24 to either .2.3 or .1.3 base on the subnet from which it comes. If you don't then setting up a route should not be necessary.

I think that auto outbound NAT for WAN should be able to handle all the subnets and give them internet. If not you are going to have to create a rule in NAT to handle that.

No additional route are needed as pfSense should be able to route to all the interface networks and the IP Alias network.
Then you just have to deal with firewall rules allowing the traffic needed.