OPNsense
  • Home
  • Help
  • Search
  • Login
  • Register

  • OPNsense Forum »
  • English Forums »
  • Tutorials and FAQs »
  • stateful rules equivalent to conntrack in iptables
« previous next »
  • Print
Pages: [1]

Author Topic: stateful rules equivalent to conntrack in iptables  (Read 302 times)

kr1p

  • Newbie
  • *
  • Posts: 7
  • Karma: 0
    • View Profile
stateful rules equivalent to conntrack in iptables
« on: January 29, 2023, 04:00:52 pm »
Hi,
I have a simple setup:
(10.0.0.1)Internet box -- (10.0.02) firewall_WAN -- firewall_LAN (192.168.1.1) -- my pc (192.168.1.2)
I would like to set a firewall rule authorizing all packets out and blocking all packets in except for related/established packets (stateful rule).
I dont find the rules i need to add to obtain this.

Could you help me with this?

Thank you.
Logged

pmhausen

  • Hero Member
  • *****
  • Posts: 2550
  • Karma: 228
    • View Profile
Re: stateful rules equivalent to conntrack in iptables
« Reply #1 on: January 29, 2023, 04:04:19 pm »
This is the default. All rules are stateful in OPNsense unless explicitly configured differently.
Logged
Supermicro A2SDi-4C-HLN4F mainboard and SC101F chassis
16 GB ECC memory
Crucial MX300 275 GB SATA 2.5" plus
Crucial MX300 275 GB SATA M.2 (ZFS mirror)
People who think they know everything are a great annoyance to those of us who do. (Isaac Asimov)

kr1p

  • Newbie
  • *
  • Posts: 7
  • Karma: 0
    • View Profile
Re: stateful rules equivalent to conntrack in iptables
« Reply #2 on: January 29, 2023, 08:37:44 pm »
Ok, but i have put a rule to allow traffic direction out and block direction in and the block in doesnt let the traffic pass if it came from rule direction out.
Is there a default policy to block traffic or am i supposed to add a rule at the end of the stack with block traffic and put rules before to allow it (in case quick is ticked)?
If i want traffic to pass from my lan to internet and block internet to lan (except for stateful packets that come back), what rule am i supposed to add to the lan interface(allow/block) and what rule to the wan interface (allow/block)?
thanks
Logged

cookiemonster

  • Hero Member
  • *****
  • Posts: 591
  • Karma: 35
    • View Profile
Re: stateful rules equivalent to conntrack in iptables
« Reply #3 on: January 29, 2023, 10:17:04 pm »
Your desired behaviour is the default, you don't need to add anything and you'll be able to see an allow all out on the LAN interface. The WAN interface defaults to block all in unless it is found as a stateful return.
For new interfaces, you need to create them all.
Logged

kr1p

  • Newbie
  • *
  • Posts: 7
  • Karma: 0
    • View Profile
Re: stateful rules equivalent to conntrack in iptables
« Reply #4 on: February 01, 2023, 03:57:09 pm »
Ok i see the default as allow all incoming connection on LAN net also...
What is the meaning of 'link#2' 'link#4' etc in system/route/status?
Logged

cookiemonster

  • Hero Member
  • *****
  • Posts: 591
  • Karma: 35
    • View Profile
Re: stateful rules equivalent to conntrack in iptables
« Reply #5 on: February 01, 2023, 10:45:26 pm »
https://docs.freebsd.org/en/books/handbook/advanced-networking/
better than trying to explain in a post.
Logged

kr1p

  • Newbie
  • *
  • Posts: 7
  • Karma: 0
    • View Profile
Re: stateful rules equivalent to conntrack in iptables
« Reply #6 on: February 03, 2023, 10:17:36 am »
thanks, so basically it's an hardware interface. it's a pitty the web gui doesnt show which "link#" each interface is assigned to in interfaces...
Logged

pmhausen

  • Hero Member
  • *****
  • Posts: 2550
  • Karma: 228
    • View Profile
Re: stateful rules equivalent to conntrack in iptables
« Reply #7 on: February 03, 2023, 10:23:04 am »
Quote from: kr1p on February 03, 2023, 10:17:36 am
thanks, so basically it's an hardware interface. it's a pitty the web gui doesnt show which "link#" each interface is assigned to in interfaces...
The "link#" means it's a locally connected route. The numbers are created dynamically and might change on subsequent boots. The hardware interface and the OPNsense assigned name can be found in the "Netif" and "Netif (name)" columns.

HTH,
Patrick
Logged
Supermicro A2SDi-4C-HLN4F mainboard and SC101F chassis
16 GB ECC memory
Crucial MX300 275 GB SATA 2.5" plus
Crucial MX300 275 GB SATA M.2 (ZFS mirror)
People who think they know everything are a great annoyance to those of us who do. (Isaac Asimov)

kr1p

  • Newbie
  • *
  • Posts: 7
  • Karma: 0
    • View Profile
Re: stateful rules equivalent to conntrack in iptables
« Reply #8 on: February 03, 2023, 10:38:03 am »
Ok thanks.
I see all my devices connected to the opnsense firewall have a route with a netif defined as l0 (loopback interface).
Isnt it a threat that connects them all together?
Logged

pmhausen

  • Hero Member
  • *****
  • Posts: 2550
  • Karma: 228
    • View Profile
Re: stateful rules equivalent to conntrack in iptables
« Reply #9 on: February 03, 2023, 10:43:25 am »
Quote from: kr1p on February 03, 2023, 10:38:03 am
I see all my devices connected to the opnsense firewall have a route with a netif defined as l0 (loopback interface).
All the IP addresses of OPNsense interfaces are local to OPNsense. So they are not routed out to the wire but handled internally. There are most probably no routes for external systems that point to lo0.

I guess that is what you are seeing. If not, please provide more detail, e.g. a screenshot.
Logged
Supermicro A2SDi-4C-HLN4F mainboard and SC101F chassis
16 GB ECC memory
Crucial MX300 275 GB SATA 2.5" plus
Crucial MX300 275 GB SATA M.2 (ZFS mirror)
People who think they know everything are a great annoyance to those of us who do. (Isaac Asimov)

kr1p

  • Newbie
  • *
  • Posts: 7
  • Karma: 0
    • View Profile
Re: stateful rules equivalent to conntrack in iptables
« Reply #10 on: February 04, 2023, 11:13:22 pm »
hi, here is the attached screenshot
Logged

  • Print
Pages: [1]
« previous next »
  • OPNsense Forum »
  • English Forums »
  • Tutorials and FAQs »
  • stateful rules equivalent to conntrack in iptables
 

OPNsense is an OSS project © Deciso B.V. 2015 - 2023 All rights reserved
  • SMF 2.0.19 | SMF © 2021, Simple Machines
    Privacy Policy
    | XHTML | RSS | WAP2