OPNsense Forum

English Forums => General Discussion => Topic started by: bondfieldh on May 19, 2025, 11:04:02 PM

Title: Let pass a omputer by Hostnamne (Device name)...
Post by: bondfieldh on May 19, 2025, 11:04:02 PM
I hope you're all doing well. I have a question regarding a Filter Rule I want to implement in my OpenSense Firewall. I want it to filter a computer by Computer Name or Host Name. That is, if my computer is called "OSAdmin1," it will only allow data traffic if the computer has that name and block all traffic to computers with that name.
I'm waiting. I hope you can help me with this question. Thank you very much for your attention, understanding, time, collaboration, cooperation, willingness, and kindness.
Title: Re: Let pass a omputer by Hostnamne (Device name)...
Post by: cookiemonster on May 19, 2025, 11:23:31 PM
Not all hosts present a usable hostname. Firewalls talk IP address language, so you need to tell the firewall how to find "the name" of the host.
As I said, not all identify themselves in a way you can be consistent. Example: see leases on your dhcp server on OPN for iphones. All iphones identify themselves as "iphone".
But you could try creating a firewall alias with the MAC address of the machine. It is not foolproof.
Remember also that if the computer has its name changed, the rule would not match anymore, regardless of how you go about it.
In short, this isn't a good approach. You can not be sure it'll work consistently.
Title: Re: Let pass a omputer by Hostnamne (Device name)...
Post by: EricPerl on May 19, 2025, 11:45:25 PM
An alias of type host(s) can be used for properly named hosts, though. FQDNs are supposedly resolved periodically.
So OSAdmin1.localdomain (by default) or OSAdmin1.xxx per LAN config.
Title: Re: Let pass a omputer by Hostnamne (Device name)...
Post by: cookiemonster on May 20, 2025, 04:00:45 PM
Yes this would work, until the host name can't be matched, then the "block" is off.
And yes, a computer or server is unlikely to have its name changed so this could be a stopgap but I'm trying to highlight to the OP that firewall rules with a hostname as the matcher is a bad design. For instance a VM or freebsd jail, container, more "smaller" compute "hosts" are very trivial to change their name.