1
20.7 Legacy Series / SYN-ACKs disappear unless State Type == none, synproxy
« on: January 02, 2021, 02:18:56 am »
Hello!
I've built a 'transparent' firewall to allow access to all superLAN resources while preventing unexpected traffic to the subLAN clients. This generally works as expected except when trying to allow superLAN clients to subLAN resources.
Creating a firewall rule allowing opt0 80/TCP traffic successfully allows inbound TCP SYN to the server. However, the server's return SYN-ACK simply disappear inside OPNsense.
As a workaround, to prevent the SYN-ACKs from disappearing, the opt0 80/TCP allow rule can have it's State Type changed to either none or synproxy. Why does the default keep state setting fail?
Moving the rule from the opt0 interface to the floating tab and leaving the default 'keep state' setting also works as expected.
I've hoping that the experts here can help me understand why these setting work or don't work. Thanks!
A few config details:
em0 -> opt0
em1 -> opt1
bridge0 (members opt0, opt1) -> bridge0
Firewall rule opt1 allow all.
net.link.bridge.pfil_local_phys == 1
net.link.bridge.pfil_member == 1
net.link.bridge.pfil_bridge == 0
I've built a 'transparent' firewall to allow access to all superLAN resources while preventing unexpected traffic to the subLAN clients. This generally works as expected except when trying to allow superLAN clients to subLAN resources.
Creating a firewall rule allowing opt0 80/TCP traffic successfully allows inbound TCP SYN to the server. However, the server's return SYN-ACK simply disappear inside OPNsense.
As a workaround, to prevent the SYN-ACKs from disappearing, the opt0 80/TCP allow rule can have it's State Type changed to either none or synproxy. Why does the default keep state setting fail?
Moving the rule from the opt0 interface to the floating tab and leaving the default 'keep state' setting also works as expected.
I've hoping that the experts here can help me understand why these setting work or don't work. Thanks!
A few config details:
em0 -> opt0
em1 -> opt1
bridge0 (members opt0, opt1) -> bridge0
Firewall rule opt1 allow all.
net.link.bridge.pfil_local_phys == 1
net.link.bridge.pfil_member == 1
net.link.bridge.pfil_bridge == 0