Hello
I wanted to allow all users to access facebook and youtube between 14.00 hrs to 16.00 hrs daily, but all other times to be blocked.
I have set firewall rules to block , its working.
To pass both sites, the following steps are made:
1) Defined schedule FreeHours_14_16_PM on all dates for 14.00 to 16.00 hrs.
2) Defined an alias - SocialSitesRestricted and added hosts www.youtube.com , www.facebook.com
3) Created a firewall rule
Action - Pass , Interface - LAN , TCP/IP version - IPV4 , Protocol - TCP/UDP , Source - LAN Net
Destination - SocialSitesRestricted , Destination Port Range - Any - Any , Category - social_networks
Schedule - FreeHours_14_16_PM, gateway - default
I also have firewall rule for " Block HTTP bypass ", "Block HTTPS bypass " , "Default allow LAN to any rule" (IPV4) , Default allow LAN IPv6 to any rule , "NAT redirect traffic to proxy " (IPV4 and IPV6)
Unfortunately, opnsense blocks facebook and youtube between 14-16 hrs. I am on a test server. I also get https certificate error for facebook, though I have other https sites working correctly.
Please request your help...
Valsaraj
Hi there,
Make sure you're not running into an alias DNS ambiguity issue: www.facebook.com and www.youtube.com have many IP addresses your alias likely won't catch.
Start fresh with a single known IP to confirm the schedule works. If it does, the alias needs to be extended to include all youtube/facebook IPs.
Cheers,
Franco
Hi Franco
Tried with single IP destination, but could not succeed...Removed schedule and tried, still failed !
Other than defining alias and rule, is there any other step ?
Thanks
Valsaraj
When using scheduled rules, the firewall actually reloads only every 15 minutes in the background. Can you take a look at your console file /tmp/rules.debug to see if the pass rule is properly injected?
I removed the existing rule, added a new rule with schedule. It reflected immediately.
Just wondering, none of the firewall rules defined by me is not executing...
I tried to pass an alias with single host youtube.com, not working...
tried to block an alias, with single host not working !
Anything wrong from my setup side !