1

Is it possible to apply firewall rules on LAN to LAN packets?

Imagine the following architecture:

Network architecture

To get a valid IP, the clients must authenticate to PfSense LAN network using 802.1x against the pfSense's radius server.

After that all packets sent between Client1 and Client2 will be managed and filtered by PfSense firewall.

Is this architecture possible? Are there any caveats?

Tiago Stapenhorst Martins
  • 343
  • 1
  • 4
  • 12
  • 1
    Layer-2 switches are transparent devices that deliver frames directly from one host to another host based on the frame (MAC) address. – Ron Maupin Feb 12 '20 at 19:29

3 Answers3

1

A "layer 2 switch" is really a switch, i.e., its only task is to forward network frames from one net branch to the other. But with today's plummeting hardware costs, many devices called "switch" have lots of additional features (like handling VLANs, faking separate networks using the same box -- essentially allowing you to separate the switch into several separate ones; filtering traffic using a variety of criteria), up to and working as routers (connecting separate networks, routing traffic as required). Often you get a "switch" that is really a router, and those generally have the smarts (hardware-wise) to do traffic filtering (i.e., act as a firewall).

For example, the "access point" or "cable modem" box you have at home is really a router and WiFi access point (connects a cabled network to WiFi) plus a firewall (doing at least NAT). If you take a peek, handling WiFi is very complex business (some channels can not be used, depending on the country; need to connect to the network and handle encrypted traffic; need to hand over from one access point to another as you move through a large building; ...), and all that is done in a WiFi card that today costs a few bucks.

vonbrand
  • 1,153
  • 2
  • 8
  • 16
  • Firewall and NAT are two completely different things, even though it is often convenient to perform the NAT on the firewall. Do not make the common mistake of thinking that NAT provides network security. Without a firewall, packets addressed to the NAT and not in the NAT tables are consumed by the NAT device itself (can be directly attacked), and if it is compromised, the entire network is open to it. Also, the firewall tables and rules are separate from the NAT tables. – Ron Maupin Feb 12 '20 at 22:09
1

In case Layer 2 switch the IP is not so important and there are traffic based on MAC address. Until the destination is on the same network segment (for Layer 3 view once it is on the same subnet - e.g. 192.168.0.0/24 - 192.168.0.1 to 192.168.0.254 ) there is utilized ARP protocol (if the MAC of the destination is not known) and then there is communication directly utilizing MAC address and "Layer 2 addressing".

In this scenario "local" traffic (between client 1 and client 2) is not reaching the pfsense so there is no way how to realize this kind of filtering...

The traffic reaching the pfsense is (in case of no special route in place) "other" traffic so everything else out of subnet - usually covered by "default" route record.

Anyway 802.1x support on the switch is not "basic" feature so in case there is this kind of support there is the most probably support also for VLANs - 802.1q. In that case you can assign client after authentication (based on the reply from the radius) to separate VLAN so logically there will be just one client and pfsense interface on the network segment or in other words you will logically split the network and no 2 clients will be on the same L2 switch. This way all the traffic will have to be routed via pfsense as default route. In this scenario you can filter the traffic also between the clients.

The cons would be higher load on firewall and in case of heavy traffic between the client there will be the most probably lower throughput.

Kamil J
  • 1,587
  • 1
  • 4
  • 10
  • So you mean there is no way to stop MAC based traffic flowing between client 1 and client 2. How bad is this for security? – Tiago Stapenhorst Martins Feb 12 '20 at 22:12
  • A switch with 802.1x support is a layer 3 switch, correct me if I'm wrong. Is it possible to do such kind of filtering with a layer 2 switch? I'm thinking in something like pfSense assigning one /31 IP to each client. This will force all traffic to be routed to pfSense before reaching its destiny. – Tiago Stapenhorst Martins Feb 12 '20 at 22:17
  • Technically layer 3 switch is router (Layer 2 is addressed by MAC and Layer 3 has IP). I didn't check it now but in case I remember it correctly the process of authentication is realized via "tunnel" to radius server. I think in principle it is "similar transformation" to DHCP relay (it catch L2 broadcast and communicate it via L3 to DHCP server and provide back the answer). So even the radius is reached via L3 the client in the process of authentication not necessary have to communicate on L3... And without DHCP answer it would be a little bit ... complicated :-D. – Kamil J Feb 12 '20 at 22:24
  • 1
    In case you are thinking about the security it cannot by done just by addressing on L3 with sharing one network segment on L2. The way can be based on 802.1x auth separate the communication by the VLAN or utilize PPPoE or any other tunnelling approach. – Kamil J Feb 12 '20 at 22:27
  • I finally understood your answer. The switch must be a L2+ with 802.1x and 802.1q support and one VLAN should be created for each user. – Tiago Stapenhorst Martins May 20 '22 at 07:19
0

I think what OP is asking is "is there a way to filter traffic within the same network" (so without the need to use a gateway which very conveniently in this case would be a firewall), I seriously doubt he is asking what is a router, a switch, a hub or a firewall. In other words, is there a way to force all nodes traffic to run through the firewall so it can filter the whole network. To my knowledge, the only network manager able to do this atm is vmware NSX-T (NSX-V is discontinued but we still refer to them) which implies you are in a virtualized environment...which is not actually that a stupid thing with VDI capabilities nowadays and yes, security is one of the VERY strong aspect of VDI.

But without this kind of technology, you are doomed, TCP/IP is made of this, if you are on the same subnet, you can reach anything without even asking any permission. Deal with it.

jmt
  • 1