OPNsense Forum

Archive => 17.7 Legacy Series => Topic started by: MS52390 on November 29, 2017, 02:34:47 am

Title: Rule enable doesn't block active traffic
Post by: MS52390 on November 29, 2017, 02:34:47 am
Hello All, kind of odd thing I am seeing with my FW:

I have WAN and LAN interfaces configured to block traffic from one specific LAN address to the rest of the LAN network (but still allow to outside WAN). With the rule enabled, pings from this LAN address to the other LAN addresses are blocked - good. However, If I disable the rule, run a -t on the ping, then enable the rule...the pings don't get blocked. I also don't see the actual blocks in the logs. Odd or just something I have set wrong?
Title: Re: Rule enable doesn't block active traffic
Post by: bartjsmit on November 29, 2017, 08:46:05 am
This is because OPNsense is a stateful firewall. https://en.wikipedia.org/wiki/Stateful_firewall

Not a bug - this behaviour is by design ;-)

Bart...
Title: Re: Rule enable doesn't block active traffic
Post by: chemlud on November 29, 2017, 09:03:19 am
...would love to see your set of rules for both, WAN and LAN.
Title: Re: Rule enable doesn't block active traffic
Post by: MS52390 on December 01, 2017, 01:46:50 am
...would love to see your set of rules for both, WAN and LAN.

Nothing is needed on the WAN side. On the LAN side, it's just a simple Block action, source: LAN, destination: LAN, source addr: single address: <VM IP>

This is because OPNsense is a stateful firewall. https://en.wikipedia.org/wiki/Stateful_firewall

Not a bug - this behaviour is by design ;-)

Bart...

I have seen other stateful firewalls conduct said action just fine. I'm not so sure it has to do with the type of firewall it is.
Title: Re: Rule enable doesn't block active traffic
Post by: chemlud on December 01, 2017, 09:06:01 am
An a LAN (= bunch of devices on a dumb switch) the traffic from LAN_IP A to LAN_IP B will never hit the router/firewall (except for the case that the router/firewall is either LAN_IP A or LAN_IP B). So I don't see how this should work at all...