Hi everyone, I’ve been asked to make a config that essentially blocks all traffic from a specific VLAN to anything on the internet other than what has been whitelisted. Its a very basic config and to test my theory I setup a lab with the following config and yet its not working, all traffic gets dropped despite having an allowed forward filter rule above containing the whitelisted addresses in a list… Am I losing my marbles here?:
And have it above all drop rules which target connections with state different than established or related (other states are: new, invalid and untracked). And possibly also above specific allow rules, with lengthy connections vast majority of packets will be matched by this rule and for performance reasons (firewall rules are evaluated from top to bottom until matching rule executes) it’s best to have this rule first so that only small number of packets pass further down the list of firewall filter rules.
The rule will make sure that e.g. reply to ICMP echo request (a.k.a. ping) will pass on the way back … if firewall first saw a corresponding ICMP echo request. In lengthy connections this rule will also match subsequent forward packets (due to connection state of established).
And the same rule will work for any other connection allowed in forward direction (e.g. HTTPS to allowed server or DNS request, etc.).
And after that you can start narrowing down your allow rules by adding a few selectors (such as in-interface or src-address-list or anything else fitting use case).
You may decide to go with connection-state=established only. However this may break some functionality. E.g. any protocol whuch requires firewall helpers, such as FTP (data connection is separate connection between same hosts but if ftp helper can detetmine ports used, such additiknal connection gets “related” connectikn-state). Or some ICMP messages, such as “Fragmentation required, and DF flag set” message necessary in PMTUD process, these are related as well.
