Hi all,
i am just wondering why i have to create rules for the way back.
I have 6 ports (1 wan, 5 different ports with 8 vlans in all) configured.
For each vlan a single gateway is configured (is that really neede, as it seems to make no difference?).
Then i have created default block rules for incoming traffic.
Now i want access an http site from vlan a to b and created a rule for that.
But in the log i can now see that in this example traffic is going to vlan b but then the it is blocked on the interface b on going out.
I thought by default the way opnsense is doing it would be stateful, so if client from vlan a is initiating the traffic i don't need to create rules for the way back?
Does anyone have a hint on that?
Thanks,
Tobi
stateful means: reply is allowed ootb. best guess without screenshots: rules on wrong interface and/or wrong direction (in/out)...
Sorry i was only on mobile and away.
After further investiagation i found out the following:
If you see the attachment block you can see that the request is not coming from the client net as source but from the GW address of the "dreck" network.
I also added the rules for the clientVLAN which is the network of my client PC and trying to access an address (192.168.177.60) at the dreck VLAN.
regards,
Tobi
Last FW amd "HAnet" rule on Dreck are wrong, direction has to be "in", not "out"... Don't use "out" rules (unless you 100% know what you are doing...), in 99.99% of the use cases the wrong choice...
THanks for your answer.
I wanted to deny all trafic by default out of the dreck network.
So how should i do that best?
Or is it that this will be done by default deny?
Interface: dreck
Source: any
Destination: any
Direction: in
Action: deny
Or simply no rule on that interface at all because deny is the default.
In/out is to be read as seen by the firewall. A packet originating in the "dreck" network is coming in the "dreck" interface.
ah ok, that was overlapping. Yes great.
After i disabled that rule and checked the logs, i can confirm that this traffic from client to dreck device is working and default deny also works for everything else.
THanks for your support!