0

I'm setting up a newtwork @ home and would like to keep Wired Devices and Wireless Devices separated.

My main network interface is on em0 - 10.0.0.1/24

I've created a VLAN on em5 - 1.0.100.1/24

This Splitting into my LAN have both same Firewall rules as most important Port 80 for http und 443 for https

When I connect a device on the WiFi or cabled to em5 port wire it starts leases IPv4 submask, Gateway, etc... but no internet access.

I'm in the end of my knowledge, trying to setup NAT rules as well, and need it to be done asap. May someone help me out to figure out where the issue may lay on? Evidence, I got some basics on networking, but obviously not an expert. Many thanks in advance for the help

Here Attached the Firewall and NAT (Outbound) Rules: Firewall Rule NAT Rule

This is what I got form Logs:

2021-03-18T22:04:41 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,63,0,0,DF,17,udp,76,83.150.6.16,85.195.227.162,35432,123,56
2021-03-18T22:04:40 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,19264,0,DF,6,tcp,52,83.150.6.16,52.114.76.34,1761,443,0,S,4062824086,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:39 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,19254,0,DF,6,tcp,52,83.150.6.16,52.114.76.34,54568,443,0,S,1167036978,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:39 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,18301,0,DF,17,udp,1378,83.150.6.16,172.217.168.10,47813,443,1358
2021-03-18T22:04:39 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,58233,0,none,17,udp,77,83.150.6.16,212.25.1.1,8981,53,57
2021-03-18T22:04:39 filterlog[32051]    17,,,0,em1,match,block,in,4,0x0,,245,54321,0,none,6,tcp,40,192.241.226.44,217.71.252.184,38659,9001,0,S,409994833,,65535,,
2021-03-18T22:04:39 filterlog[32051]    107,,,0,em1,match,pass,out,4,0xb8,,64,3624,0,none,17,udp,76,83.150.6.16,185.101.158.113,123,123,56
2021-03-18T22:04:36 filterlog[32051]    17,,,0,em1,match,block,in,4,0x0,,250,51649,0,none,6,tcp,40,45.155.205.22,217.71.252.184,56937,17214,0,S,39810631,,1024,,
2021-03-18T22:04:36 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,19245,0,DF,6,tcp,52,83.150.6.16,52.114.76.34,39976,443,0,S,667640876,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:35 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,19235,0,DF,6,tcp,52,83.150.6.16,52.114.76.34,18509,443,0,S,2993066276,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:34 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,254,42447,0,none,17,udp,76,83.150.6.16,185.101.158.113,37296,123,56
2021-03-18T22:04:33 filterlog[32051]    106,,,0,em0,match,pass,in,4,0x0,,64,3957,0,DF,6,tcp,64,10.0.0.221,10.0.0.1,58192,443,0,S,4273592887,,65535,,mss;nop;wscale;nop;nop;TS;sackOK;eol
2021-03-18T22:04:33 filterlog[32051]    106,,,0,em0,match,pass,in,4,0x0,,64,39778,0,DF,6,tcp,64,10.0.0.221,10.0.0.1,58191,443,0,S,2199747829,,65535,,mss;nop;wscale;nop;nop;TS;sackOK;eol
2021-03-18T22:04:33 filterlog[32051]    106,,,0,em0,match,pass,in,4,0x0,,64,8281,0,DF,6,tcp,64,10.0.0.221,10.0.0.1,58190,443,0,S,3598387476,,65535,,mss;nop;wscale;nop;nop;TS;sackOK;eol
2021-03-18T22:04:32 filterlog[32051]    102,,,0,em3,match,pass,out,4,0x0,,55,36866,0,DF,17,udp,607,80.218.157.162,10.10.10.12,62379,5060,587
2021-03-18T22:04:32 filterlog[32051]    6,,,0,em1,match,rdr,in,4,0x0,,56,36866,0,DF,17,udp,607,80.218.157.162,10.10.10.12,62379,5060,587
2021-03-18T22:04:31 filterlog[32051]    107,,,0,em1,match,pass,out,4,0xb8,,63,38522,0,none,17,udp,76,83.150.6.16,185.17.70.106,18824,123,56
2021-03-18T22:04:31 filterlog[32051]    17,,,0,em1,match,block,in,4,0x0,,250,10146,0,none,6,tcp,40,45.155.205.22,217.71.252.185,56937,17214,0,S,2485884965,,1024,,
2021-03-18T22:04:30 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,19225,0,DF,6,tcp,52,83.150.6.16,52.114.76.34,55731,443,0,S,1401231552,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:30 filterlog[32051]    17,,,0,em1,match,block,in,4,0x0,,250,36948,0,none,6,tcp,40,195.54.161.151,217.71.252.184,42919,18087,0,S,2339187275,,1024,,
2021-03-18T22:04:30 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,254,14908,0,none,17,udp,76,83.150.6.16,185.101.158.113,37615,123,56
2021-03-18T22:04:28 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,15449,0,DF,6,tcp,52,83.150.6.16,92.123.16.55,42328,80,0,S,2307379948,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:28 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,15442,0,DF,6,tcp,52,83.150.6.16,92.123.16.55,64047,80,0,S,959258948,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:27 filterlog[32051]    17,,,0,em1,match,block,in,4,0x0,,53,6343,0,none,1,icmp,170,103.106.101.42,10.10.10.12,datalength=150
2021-03-18T22:04:26 filterlog[32051]    17,,,0,em1,match,block,in,4,0x0,,250,56227,0,none,6,tcp,40,194.147.140.151,83.150.6.16,41494,16360,0,S,1653989979,,1024,,
2021-03-18T22:04:23 filterlog[32051]    17,,,0,em1,match,block,in,4,0x0,,249,57853,0,none,6,tcp,40,45.155.205.23,217.71.252.187,56965,18582,0,S,73160144,,1024,,
2021-03-18T22:04:23 filterlog[32051]    17,,,0,em1,match,block,in,4,0x0,,250,60255,0,none,6,tcp,40,89.248.165.134,217.71.252.187,49889,334,0,S,3138066090,,1024,,
2021-03-18T22:04:22 filterlog[32051]    17,,,0,em1,match,block,in,4,0x0,,250,11396,0,none,6,tcp,40,45.155.205.25,83.150.6.16,57020,23626,0,S,3635967710,,1024,,
2021-03-18T22:04:21 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,19216,0,DF,6,tcp,52,83.150.6.16,52.114.76.34,21204,443,0,S,1211010097,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:21 filterlog[32051]    106,,,0,em0,match,pass,in,4,0x0,,64,37230,0,DF,6,tcp,64,10.0.0.221,10.0.0.1,58181,443,0,S,2777223674,,65535,,mss;nop;wscale;nop;nop;TS;sackOK;eol
2021-03-18T22:04:21 filterlog[32051]    106,,,0,em0,match,pass,in,4,0x0,,64,46060,0,DF,6,tcp,64,10.0.0.221,10.0.0.1,58180,443,0,S,391641428,,65535,,mss;nop;wscale;nop;nop;TS;sackOK;eol
2021-03-18T22:04:21 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,63,9600,0,DF,17,udp,76,83.150.6.16,195.186.1.101,34259,123,56
2021-03-18T22:04:20 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,15435,0,DF,6,tcp,52,83.150.6.16,92.123.16.55,8625,80,0,S,2928142443,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:20 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,19206,0,DF,6,tcp,52,83.150.6.16,52.114.76.34,24278,443,0,S,1767291962,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:20 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,15428,0,DF,6,tcp,52,83.150.6.16,92.123.16.55,44948,80,0,S,1307821345,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:20 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,59452,0,none,17,udp,48,83.150.6.16,54.39.182.217,6582,3478,28
2021-03-18T22:04:19 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,56252,0,DF,6,tcp,52,83.150.6.16,52.155.217.156,41065,443,0,S,1640842740,,65535,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:19 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,44325,0,none,17,udp,77,83.150.6.16,212.25.1.1,28953,53,57
2021-03-18T22:04:19 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,15421,0,DF,6,tcp,52,83.150.6.16,92.123.16.55,59160,80,0,S,869024798,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:19 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,15415,0,DF,6,tcp,52,83.150.6.16,92.123.16.55,12784,80,0,S,1849171159,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:18 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,15409,0,DF,6,tcp,52,83.150.6.16,92.123.16.55,62544,80,0,S,161666798,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:18 filterlog[32051]    17,,,0,em1,match,block,in,4,0x0,,250,46986,0,none,6,tcp,40,89.248.165.51,217.71.252.184,52433,9889,0,S,3989138835,,1024,,
2021-03-18T22:04:18 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,15402,0,DF,6,tcp,52,83.150.6.16,92.123.16.55,20728,80,0,S,256349197,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:18 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,15396,0,DF,6,tcp,52,83.150.6.16,92.123.16.55,24120,80,0,S,1144032219,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:17 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,15388,0,DF,6,tcp,52,83.150.6.16,92.123.16.55,48171,80,0,S,1508203119,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:17 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,15382,0,DF,6,tcp,52,83.150.6.16,92.123.16.55,48957,80,0,S,1310058054,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:17 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,15375,0,DF,6,tcp,52,83.150.6.16,92.123.16.55,58227,80,0,S,104299183,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:17 filterlog[32051]    107,,,0,em1,match,pass,out,4,0xb8,,64,38258,0,none,17,udp,76,83.150.6.16,81.94.123.17,123,123,56
2021-03-18T22:04:17 filterlog[32051]    17,,,0,em1,match,block,in,4,0x0,,243,24272,0,none,6,tcp,40,167.172.196.139,10.10.10.12,41444,22,0,S,2940379772,,1024,,
2021-03-18T22:04:17 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,15369,0,DF,6,tcp,52,83.150.6.16,92.123.16.55,23185,80,0,S,2887461935,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:16 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,15362,0,DF,6,tcp,52,83.150.6.16,92.123.16.55,46039,80,0,S,989286045,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:16 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,19196,0,DF,6,tcp,52,83.150.6.16,52.114.76.34,19825,443,0,S,1003626970,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:16 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,15356,0,DF,6,tcp,52,83.150.6.16,92.123.16.55,40614,80,0,S,444175405,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:16 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,15346,0,DF,6,tcp,52,83.150.6.16,92.123.16.55,47779,80,0,S,2292164279,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:16 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,15338,0,DF,6,tcp,52,83.150.6.16,92.123.16.55,14489,80,0,S,180312848,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:15 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,63,56844,0,DF,1,icmp,84,83.150.6.16,13.224.90.95,datalength=64
2021-03-18T22:04:15 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,63,23797,0,DF,17,udp,57,83.150.6.16,212.25.3.3,65261,53,37
2021-03-18T22:04:15 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,63,49127,0,DF,17,udp,57,83.150.6.16,212.25.1.1,64398,53,37
2021-03-18T22:04:15 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,19186,0,DF,6,tcp,52,83.150.6.16,52.114.76.34,53431,443,0,S,3903042360,,64240,,mss;nop;wscale;nop;nop;sackOK
2021-03-18T22:04:15 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,127,44324,0,none,17,udp,75,83.150.6.16,212.25.1.1,33542,53,55
2021-03-18T22:04:13 filterlog[32051]    17,,,0,em1,match,block,in,4,0x0,,251,11789,0,none,6,tcp,40,35.205.46.98,83.150.6.16,41402,4040,0,S,777463765,,1024,,
2021-03-18T22:04:12 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,63,20241,0,none,17,udp,1378,83.150.6.16,172.217.194.94,30576,443,1358
2021-03-18T22:04:12 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,63,47163,0,none,17,udp,63,83.150.6.16,212.25.1.1,18505,53,43
2021-03-18T22:04:11 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,63,28635,0,none,17,udp,1378,83.150.6.16,172.217.168.46,57631,443,1358
2021-03-18T22:04:11 filterlog[32051]    17,,,0,em1,match,block,in,4,0x0,,115,9362,0,none,17,udp,112,188.146.132.63,217.71.252.185,52967,52960,92
2021-03-18T22:04:10 filterlog[32051]    107,,,0,em1,match,pass,out,4,0xb8,,64,56152,0,none,17,udp,76,83.150.6.16,84.31.225.166,123,123,56
2021-03-18T22:04:08 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,63,52134,0,none,17,udp,70,83.150.6.16,212.25.1.1,15654,53,50
2021-03-18T22:04:08 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,63,36988,0,DF,6,tcp,64,83.150.6.16,104.16.19.94,4708,443,0,S,2467279370,,65535,,mss;nop;wscale;nop;nop;TS;sackOK;eol
2021-03-18T22:04:08 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,63,48549,0,none,17,udp,1378,83.150.6.16,104.16.19.94,12614,443,1358
2021-03-18T22:04:08 filterlog[32051]    107,,,0,em1,match,pass,out,4,0x0,,63,51588,0,none,17,udp,66,83.150.6.16,212.25.1.1,53129,53,46
Gianni
  • 1
  • 2
  • Difficult to know without seeing the rules, but did you set up the outbound NAT for the second interface? – Quetza Mar 17 '21 at 09:38
  • Hello Quetza Yes, I've setup following Firewall rules: IPv4 (TCP/UDP) AnyPort for VPN, IPv4 (any) AnyPort for VPN, IPv4 (any) AnyPort for em5, IPv6 (any) AnyPort for em5, IPv4 (TCP) Port 80 for em5, IPv4 (TCP) Port 443 for em5. NAT Outbound Rule-> interface - em5, Source - 10.0.100.0/24 (Source Port - any, Destination - any, Destination Port- any), NAT Address - em5 adsress, NAT Port - any, Static Port - YES – Gianni Mar 17 '21 at 09:59
  • Please can you update your question with screenshots of the firewall and NAT rules? – Quetza Mar 17 '21 at 18:00
  • Hello Quetza, updated question on last line with Firewall & NAT rule. Thanks in advance for support. – Gianni Mar 18 '21 at 09:07
  • Please can you expand the automatically generated firewall rules and show all the NAT outbound rules including the automatic ones and include the headers and rest of the page. Also, please enable logging for all the rules so we can get more information from the logs. – Quetza Mar 18 '21 at 17:40
  • Updated Images and Logfile attached. – Gianni Mar 18 '21 at 21:11
  • Nothing in your logs are triggering em5. What happens if you ping the gateway (OPNsense) IP address on 10.0.100.1 from one of those hosts in the 10.0.100.0/24 network? Does it respond? What's the line in the log? Some other things that look worth exploring are that you don't have a firewall rule allowing access from ESL_Labor (which matches your IP address range above so I'm guessing that's the right network) to get anywhere and you also don't have a NAT rule on the ESL_Labor interface. – Quetza Mar 19 '21 at 15:52
  • Apologies the late reply. It looked like the em5 hasn't any NAT passthrough activated. Once I did so, em5 came up and DHCP was assigning IP's . so for the moment Looks like all Devices are well connected to the network. I still have by the way to figure out, how to properly configure em0 allow em5, em5 deny em0 on the firewall rules. – Gianni Mar 23 '21 at 17:51
  • Does that mean your question is solved? – Quetza Mar 23 '21 at 21:45
  • Yes, this is right, question solved. I'll later on Post an Answer to this question, with solution. Thanks for your time and engagement Quetza, much appreciated your reply and engagement. – Gianni Mar 24 '21 at 09:43

0 Answers0