Solved PF with DMZ - Can't ping from the Firewall/GW itself (AGAIN!)

Aknot

Aknot

I'm lost!

I have replaced my last configuration to use DMZ instead, and everything "seems" to be working, except one thing, I can't ping and resolv hostnames from the gateway itself.
I need to be able to update and install on the firewall/GW/Router itself, and that doesn't work right now.

I can ping IP addresses!
Pinging host names is giving me error: # ping google.com => ping: UDP connect: No route to host

This is what I have right now:

rc.conf

Code: 
## NETWORK
gateway_enable="YES"
defaultrouter="192.168.8.1" # Huawei 5G router as a test WAN connection, DHCP to if ale0.
ipv6_network_interfaces="none"
ip6addrctl_enable="NO"
dhcpd_enable="YES"
dhcpd_ifaces="igb0 igb1"

## WAN
ifconfig_ale0="DHCP"

## LAN 192.168.1.0/24
ifconfig_igb0="inet 192.168.1.1 netmask 255.255.255.0"

## DMZ 172.16.1.0/24
ifconfig_igb1="inet 172.16.1.1 netmask 255.255.255.0"

resolv.conf

Code: 
nameserver 1.1.1.1
nameserver 8.8.8.8
nameserver 8.8.4.4

fp.conf

Code: 
# =======================================================================
# 0. SETTINGS
# =======================================================================

# DHCP => Internet (WAN)
ext_if = "ale0"

# 192.168.1.0/24 => Home network
lan_if = "igb0"

# 172.16.1.0/24 => DMZ network
dmz_if = "igb1"

lan_net = $lan_if:network
dmz_net = $dmz_if:network

# Web server IP address in DMZ subnet
#web_server = "172.16.1.50"

# Test on HP Pavilion laptop
web_server = "172.16.1.120"

# Ports allowed to the web server (HTTP and HTTPS)
web_ports = "{80,443}"

# =========================================================================
# 1. TABLES & OPTIONS
# =========================================================================
set skip on lo0 # Ignore local traffic (loopback)

# =========================================================================
# 2. NAT & PORT FORWARDING (Address translations)
# =========================================================================

# Share Internet access to both the home network and DMZ (NAT)
nat on $ext_if from $lan_net to any -> ($ext_if)
nat on $ext_if from $dmz_net to any -> ($ext_if)

# NAT rule for DMZ out on WAN
nat on $ext_if from $dmz_if:network to any -> ($ext_if)

# =========================================================================
# 3. REDIRECTS
# =========================================================================

# Redirect incoming traffic from Internet to the web server on ports 80 and 443
rdr on $ext_if inet proto tcp from any to ($ext_if) port $web_ports -> $web_server

# Redirect incoming traffic on WAN port 25200 to web server port 25200 in DMZ
rdr on $ext_if proto tcp from any to ($ext_if) port 25200 -> $web_server port 25200

# =========================================================================
# 4. FIREWALL RULES (FILTERING)
# =========================================================================

# Start by block all
block all

# Allow DHCP (UDP on port 67/68) on both LAN and DMZ
pass in quick on $lan_if proto udp from any port 68 to any port 67
pass in quick on $dmz_if proto udp from any port 68 to any port 67

# Allow ping for DNS from the firewall on WAN
pass out quick on $ext_if proto { udp, tcp } to any port 53 keep state

# Allow ping with external DNS (e.g. 1.1.1.1)
pass in quick on $lan_if proto { udp, tcp } from $lan_if:network to any port 53 keep state

# Allow SSH to the Firewall on port 25200 from Internet
pass in quick on $ext_if proto tcp from any to ($ext_if) port 25200 synproxy state

# Allow SSH to the Firewall on port 25200 from LAN
pass in quick on $lan_if proto tcp from $lan_if:network to 192.168.1.1 port 25200 keep state

# Allow SSH to the web server on port 25200 from DMZ
pass in quick on $ext_if proto tcp from any to $web_server port 25200 synproxy state

# Allow SSH to the web server on port 25200 from LAN
pass in quick on $lan_if proto tcp from $lan_if:network to $web_server port 25200 keep state

# Block all traffic from DMZ to LAN
block in quick on $dmz_if to $lan_net

# Block DMZ to reach the FreeBSD-routers own internal IP addresses
block in quick on $dmz_if to ($lan_if)

# Allow outgoing traffic to the Internet from the FreeBSD-router
pass out on $ext_if proto { tcp, udp, icmp } all

# Allow incoming traffic from WAN (Internet) to the web server
pass in quick on $ext_if proto tcp to $web_server port $web_ports

# Allow LAN to the router, Internet and DMZ
pass in on $lan_if from $lan_net to any
pass out on $lan_if to $lan_net

# Allow the web server to Internet, but not to the LAN
pass in on $dmz_if from $dmz_net to any
pass out on $dmz_if to $dmz_net

# Allow the DMZ to reach the Internet (everything except LAN)
pass in quick on $dmz_if proto { tcp, udp, icmp } from $dmz_if:network to ! $lan_if:network keep state

Thanks,
 
" Pinging host names is giving me error: # ping google.com => ping: UDP connect: No route to host "

As the err msg says UDP and not ICMP , its a name lookup issue with DNS probably.

Ping utility cant convert hostname to IP-address. How is the Gateway Machine's DNS resolution configured ?
 
The host itself isn't allowed to query DNS. Don't set defaultrouter if you use DHCP on ale0.
 
Thank you everyone!

Found some information this morning about IPv6, and that the problem could be related to FreeBSD preferring v6 over v4.

So I tried the following:

Code: 
$ ping -4 google.com
PING google.com (172.217.19.238): 56 data bytes
64 bytes from 172.217.19.238: icmp_seq=0 ttl=112 time=7.728 ms
64 bytes from 172.217.19.238: icmp_seq=1 ttl=112 time=7.543 ms
64 bytes from 172.217.19.238: icmp_seq=2 ttl=112 time=7.897 ms
...

So I added the following to /etc/rc.conf

Code: 
ipv6_enable="NO"
ipv6_network_interfaces="none"
ipv6_activate_all_interfaces="NO"
ip6addrctl_enable="YES"
ip6addrctl_policy="ipv4_prefer"

Now everything seems to be working as it should!
This was new to me (AGAIN) 🙃
 
You must log in or register to reply here.
Back
Top