Block all trafic from alias (ip range)

[s3b0]

Hi,

I'm trying to block all traffic from ip range(via alias) but nothing is working - didn't have this problem on my prevoiuse firewall, but with opnsense i can't make it work, maybe i'm missing something.

IP range for block is 192.168.2.50-192.168.2.59 (alias: Cameras, type of alias is Hosts)
You cannot view this attachment.

From desperation i made redundant rules in WAN and LAN interface:
You cannot view this attachment.
You cannot view this attachment.

But - even - after resetting States, opnsense shows me
You cannot view this attachment.

and one of my crap cam is still connected to its cloud.

What i'm doing wrong?

[Patrick M. Hausen]

The cameras are connected to LAN, right? To block traffic from the cameras to the Internet the rules needs to be:

Action: block
Interface: LAN
Direction: in
Source: cameras
Destination: any

The packets from the cameras are coming IN through the LAN interface when you picture a little daemon sitting inside the firewall watching the traffic.

That's explained in the documentation:

https://docs.opnsense.org/manual/firewall.html#direction

You practically never use "out" rules.

[s3b0]

Thx - fixed thanks to you.

So i should consider directions way different, "in" is from my net(into internet) and "out" is to my net(from internet)?

Like this:
Internet -> Out rule of Wan -> Out rule of LAN -> LAN
Internet <- In rule of Wan <- In rule of LAN <- LAN
or like this:
Internet -> In rule of Wan -> Out rule of LAN -> LAN
Internet <- Out rule of Wan <- In rule of LAN <- LAN

??

[meyergru]

Not exactly - the direction is from the interface's Point of view. It is explained in the documentation.

[Patrick M. Hausen]

Not exactly - the direction is from the interface's Point of view. It is explained in the documentation.

To elaborate on that - as I wrote picture a little BSD daemon [1] sitting inside your firewall. When a client on LAN initiates a connection to "the Internet" the first packet the daemon sees is coming in from the LAN interface.

If you want to publish an internal server to be accessible from the Internet, the first packet is coming in from an arbitrary system on the Internet to the WAN interface.

You really need to picture packets and the interfaces they pass through.

[1] https://en.wikipedia.org/wiki/BSD_Daemon

[s3b0]

Got it - thx :)