OPNsense Forum

Archive => 19.7 Legacy Series => Topic started by: Death_Master on January 20, 2020, 10:31:17 pm

Title: Having weird problem with default rule blocking some IPs and ports
Post by: Death_Master on January 20, 2020, 10:31:17 pm

Hello.
I have a frustrating problem - from LAN i cannot access socks proxy outside while for example ICMP and HTTP are working perfectly.
Just installed opnsense on that router today so config is fresh.
What i see in logs - "Default deny rule" is blocking connections to socks proxy (LAN, direction=in).
Did try to setup rules for allowing all in on LAN, on WAN, on floating rules in any direction, nothing helps.
Can someone explain me hidden rules(as i did not see any that should block my traffic) that can contribute to default block?
How to fix the problem?
I need just simple setup that allows all LAN traffic pass out and all WAN return well when requested from LAN with a little shaping(shaping part i did setup already).

Title: Re: Having weird problem with default rule blocking some IPs and ports
Post by: bartjsmit on January 21, 2020, 09:31:20 pm

Is the proxy on an RFC 1918 address range? The default OPNsense config blocks those on the WAN

Bart...

Title: Re: Having weird problem with default rule blocking some IPs and ports
Post by: Death_Master on January 22, 2020, 06:46:42 am

No, it is on internet range.
If you want exact address - its on 80.246.31.3:1080 .

Title: Re: Having weird problem with default rule blocking some IPs and ports
Post by: siga75 on January 24, 2020, 07:10:50 am

default deny is a "last match" rule, so if that does match it means your created rules didn't match, have you created them as "first match"? can you post a screenshot?

Title: Re: Having weird problem with default rule blocking some IPs and ports
Post by: Death_Master on January 24, 2020, 07:41:14 am

here is screenshot:
https://prnt.sc/qs4eqc

Title: Re: Having weird problem with default rule blocking some IPs and ports
Post by: siga75 on January 24, 2020, 07:58:32 am

you didn't select source, put "any" or "LAN net", also provide a screenshot of the lower part, destination should also be set to any