Unable to block traffic IN to LAN

[squarepantsii]

Hi,

I am having trouble with trying to block traffic IN to LAN to a specific public IP (e.g., Blocked_Internet_IP).
The firewall Log Files (Live View) is not showing any traffic when I send the traffic from a LAN host to this blocked IP on port 80, using "telnet Blocked_Internet_IP 80".

Strangely enough, the Firewall Log Files does show this connection OUT to WAN, to this Blocked_Internet_IP on port 80.
Furthermore, if I run a pcap capture (Interfaces -> Diagnostics) on the LAN interface, I can clearly see the traffic being received - which I assume must mean this is an IN traffic to the LAN interface.

I could create Block rules on the Firewall using WAN Interface OUT, but I understand this is not encouraged, therefore I would like to get to the bottom of this.

Thanks in advance for any tips.

[Patrick M. Hausen]

Please show your rule in detail.

[squarepantsii]

Thanks for replying.
I have attached the screenshots (not sure how to make it appear in post!)

This is the LAN rule.


This is the WAN rule.


This is the log files Live View.

[jp0469]

It looks like you're trying to block LAN clients from reaching a particular Adguard DNS server? From your 1st screenshot, it appears you put the rule after the "allow all" rules. That's not going to work since the "allow all" rule will be matched first and all following rules ignored. Once you fix that, the 2nd rule you posted is not needed.

[squarepantsii]

Hi,

Thank you for the reply. I have been busy with trying to test Wazuh with OPNsense.

As a follow up, I am now using the alias '__wazuh_agent_drop' to effect a firewall block to the same Adguard DNS (94.140.14.14).
I am able to run the Wazuh active response script, which updates this alias to include the IP address 94.140.14.14.

I have attached the automatically generated rules (built-in by OPNsense), which includes the supposedly block rule in the LAN IN interface.

However, this rule is not being triggered. I verified this from the Live View log files. There's no blocking.

If I then test it with a WAN OUT rule that blocks __wazuh_agent_drop, the block is triggered successfully.

[jp0469]

It's still not very clear what you're trying to accomplish. Post a screenshot of all rules (excluding the auto ones) on your LAN interface. Just showing the one rule isn't relevant because the order of the rules matters.

[squarepantsii]

I do apologise. I intended to attach 2 pictures previously, but one of them exceeded the max size and it wasn't attached.

I have now re-attached the 2 pictures. These 2 makes up the LAN auto-generated rules, which I understand to precede all other rules. If I understand correctly, all these rules are auto-gen and should be the same across any installation of OPNsense. This alias is auto-gen in *both* LAN and WAN rules, and both are set to block the IN direction.

What I am doing now is - I am using the __wazuh_agent_drop alias to block a particular IP, in this case 94.140.14.14. I have already ascertained that the Adguard IP is in the alias when I am testing the blocking.

What I don't understand is why the blocking does not occur. I don't see any preceding rule (before __wazuh_agent_drop) that triggers before it.

I am connecting a telnet session from a PC on the LAN to the Adguard IP.

[Seimus]

So you are running all you rules, even the one specific for IN on LAN as floading?

Also did you do purge the state table after implementing that rule?
That Alias, does it have at all any IPs or Subnets loaded? (check in Diagnostic Alias)

Regards,
S.