42 thoughts on “Secure FreeNAS 9.2.1.2 with a Firewall”

1. Pingback: OpenVPN on FreeNas 9.1 | The Joe Paetzel Method

2. After activating the firewall I got a syntax error on my pf.conf file. The status says is running and I don’t see any problems in the file. Any idea why this happened?

   Reply
   • That’s hard to say without seeing the pf.conf file you are using.

     Reply
     • #change this to match your primary ethernet interface, re0 or em0 are common, but there are others
       ext_if=”em0″
       vpn_if=”tun0″
       #These are all of the other interfaces we discovered in step 2
       set skip on re0
       set skip on lo0
       set skip on bridge0
       set skip on ipfw0
       set skip on epair0a
       set skip on epair1a
       set skip on epair2a
       set skip on epair3a
       set skip on epair4a
       set skip on epair5a
       set skip on tun0
       set block-policy return
       scrub in all
       #change xxx.xxx.xxx.xxx to the external IP of your FreeNAS box
       nat on $ext_if from 10.8.0.0/24 to any -> 192.168.1.8
       #Lock it down
       block in all
       block out all
       #Allow VPN traffic
       pass on tun0 keep state
       block quick from
       #Allow traffic in for ssh
       pass in on $ext_if proto tcp from any to any port 22 flags S/SA keep state
       #Allow traffic in for web – delete or comment out if you don’t want web traffic
       pass in on $ext_if proto tcp from any to any port 80 flags S/SA keep state
       pass in on $ext_if proto tcp from any to any port 443 flags S/SA keep state
       #Allow traffic in for OpenVPN
       pass in on $ext_if proto udp from any to any port 1194 keep state label “openvpn”
       #Allow LAN traffic to connect to FreeNAS – change xxx.xxx.xxx.0 to match your network, ie 192.168.0.0 or 10.0.0.0
       pass in on $ext_if from 192.168.1.0/24 to any keep state
       #Allow traffic out from the LAN
       pass out on $ext_if from any to any keep state
     • Looks like you dropped all the brute force stuff. After “pass on tun0 keep state”…delete “block quick from”.
3. I was troubleshooting that is why I took out the brute force things. I added it back in and deleted that line.

   Reply
   • I just stopped and started it with the changes and there is still a syntax error.

     Reply
     • Ok the syntax error was pointing at the line that has the brute force info. Once I deleted it, the error went away. Is there in an error above?
4. Yes, there was an error. WordPress decided not to “print” the parts. It should be this…I fixed it above:

   table <bruteforce> persist

   block quick from <bruteforce>

   Thanks for catching this!!!

   Reply
   • I think you are also missing a <bruteforce> in the port 22 line after overload also

     Reply
     • Yes…darn wordpress. Fixed it above…should be this:

       pass in on $ext_if proto tcp from any to any port 22 flags S/SA keep state (max-src-conn 10, max-src-conn-rate 5/5, overload <bruteforce> flush global)
5. Hi Joe!
   First off, thank you for your OpenVPN tutorials. They have been extremely informative and well written, thank you for taking the time to make them. I couldn’t imagine setting up my system without them.
   However, like most posters I imagine, I’m here because I encountered problems and I lack the technical expertise to fix them on my own. I’ve followed your guide as closely as possible but I’ve failed to successfully implement the packet filter. It runs and I have no issue with internet access from the VPN client device but I’m unable to reach devices on the local lan. When checking the pf status I see zero movement of packets! Is this because the lan is behind a router?
   Thanks again! 🙂

   Reply
   • Hi Tristan –
     I really appreciate the kind words regarding the guides!

     So help me understand. Is the FreeNAS box behind the same router? What type of port forwarding are you doing on the router? Could you email me your output from ifcong , and your pf.conf file? You can use the email form on the about page. Might as well include the openvpn server config file. Feel free to xxx.xxx.xxx.xxx out the ip’s.

     Reply
     • Done! Thanks Joe, it’s really appreciated. I’m looking forward to hearing back from you!
6. Fabulous, what a weblog it is! This website presents helpful facts to us,
   keep it up.

   Reply
7. A superb guide! I had been struggling with getting this done for ages and it worked flawlessly.

   A small tip in case you would like to route all your traffic over the VPN server once connected, including that to the internet is to add these 2 lines to your openvpn.conf file:

   push “redirect-gateway def1”
   push “dhcp-option DNS 8.8.8.8”

   Chose your own DNS server by all means, this is a Google one.

   Reply
8. Hi Joe,
   First of all, great tutorial 🙂
   I’ve followed the OpenVPN one, and then i wanted to configure some firewall rules.
   I’ve followed all of the tutorial,yet the openVPN port is still CLOSED from outside.

   Have you any idea why it’s happening ?
   Thanks in advance,
   Regards,
   Bastien DINE

   Reply
   • Hi there-

     I assume you forwarded the port through your router. The VPN works without the firewall rules in place…correct? Do you have the correct interface in your ruleset? Might be em0, re0…or a slew of other possibilities.

     Reply
   • Also, thanks for the compliment and thanks for reading.

     Reply
9. Hi Joe, I have a question.

   I followed your guide and everything goes smoothly but when I reboot my FreeNAS I cannot access to my Plugins, I need to stop pf and start again, and then everything works.
   Do you know why this is happening?
   Maybe it’s a hardware issue?
   It’s like the system needs to load first the interfaces for each plugin and then start the firewall.

   Thanks for all your blog 🙂

   Reply
   • Of and vimage jails don’t get along. Sounds like an issue with that.

     Reply
10. Question about:

    “change xxx.xxx.xxx.xxx to the external IP of your FreeNAS box”

    Is that referring to the LAN IP it’s getting from the router, or referring to actual external IP (WAN)?

    Reply
    • If you are passing an IP through then it is the public IP for the FreeNAS box. If you are forwarding a port on the router, then it is the LAN IP for FreeNAS. If you are forwarding the port, then on the client config, be sure to use the public IP of your router.

      Reply
    • Hmmm, just realized which post you were commenting on. My answer probably didn’t make a lot of sense. I had assumed if you are setting up a firewall, that you have a public IP assigned to your FreeNAS box. I guess it would probably work without one. So yeah, you should be able to use an internal IP. Long story short, it needs to be an IP on the FreeNAS box.

      Reply
      • Thanks =] Your first reply answered it, I am forwarding 1194 within OpenWRT to the LAN IP and have the server.conf setup to use the ddns host name for the WAN IP
    • (As a heads up, I just recently delved into UNIX based OSes and am learning as I go)
      Also, i wanted to understand what each command meant, so I looked at the rule syntax page, and according to the description of pf (link below), it states:

      “Filter rules are evaluated in sequential order, first to last. Unless the packet matches a rule containing the quick keyword, the packet will be evaluated against all filter rules before the final action is taken. The last rule to match is the “winner” and will dictate what action to take on the packet.”

      I take this to mean that it starts at the top of script and works it way down, so does this mean the default of deny all should be at the bottom of the script instead of the top? Thanks =]

      Reply
      • Hi James. Read that snippet again. Last rule to match is the winner. So if you end with Deny All, no packets would get through. The exception are any “quick” rules.
      • Thanks a bunch =]
11. I have a server board with 2 LANS and an IPMI LAN… can I simply add the additional LAN on the next line below the first, such as:

    ext_if=”igb0″
    ext_if=”igb1″
    vpn_if=”tun0″
    vpn_net='”10.8.0.0/24″‘
    table persist

    Reply
    • Nope. I don’t think so. ext_if is a variable, so by defining it twice, my guess is, only the last setting would stay. So in your example, ext_if = igb1

      Not sure if you can define multiple interfaces with commas. I’d say, just use ext_if and ext2_if.

      Are all three NIC’s being used? You probably only need to set up one of them for your standard rules and then the IPMP NIC you’d want separate rules for anyway.

      Reply
      • Currently only eth1 and the IPMI LAN are being utilized. Once I get all the wiring ran (server will be in different board than the router) all three LANs will be hooked up with aggregation on eth0 and eth1 and the IPMI bound to its own port
      • **room, not board lol
      • OK, looks like this is maybe the way you’d want things:

        ext_if = “igb0”
        ext_if2 = “igb1”
        all_ext_if = “{” $ext_if $ext_if2 “}”

        Then use $all_ext_if anywhere you want a rule to refer to both interfaces.
      • Might also work to just do:

        ext_if = “{ igb0, igb1}”

        You’ll need to test that out.
12. Thanks a bunch =]

    Reply
13. int_if=”em0″
    localnet = $int_if:network
    pass in on $int_if from $localnet to any keep state

    now no need to edit to match your network

    Reply
    • Thanks! =]

      Reply
14. Thank you for this wonderfull tutorial – again 🙂

    One error has been bugging me for an houre, maybe because I am some kind of noob.

    Whenever I fired the pf up I got an error message on the last line of the pf.conf file, no matter what it contains.

    I turns out that I edited the conf-file with Adobe Dreamweaver and had to add an extra empty line at the end of the file.

    Maybe you can right it as an additional info for someone like me who has the same
    problems.

    Reply

15. Pingback: Configurando packet filtering en FreeNAS 9.3 | Tutoriales CECT

16. Hey, thank you very much for this!
    I found this, because I was wondering, if it can be used to make the built-in TFTP-server a little bit more secure. I only need TFTP availably for a certain IP range in the network (like 10.0.0.20 – 10.0.0.30). In this range IP-Phones reside and should be able to load their config files – no other network client outside of the range should be able to do this.
    Is it possible to adapt the code for this application?
    Thanks a lot for your help and have a Merry Christmas!

    Reply
    • Hi Michael-
      I have not played with FreeNAS for a very long time. All of the custom stuff I did was on now, very old versions. I have no way of knowing if this will work on a current version of FreeNAS. All that said,
      you should be able to do that. TFTP runs on port 69 by default. To specify a range of IP’s you just use a hyphen, so 10.0.0.20 – 10.0.0.30 .

      So something like this might work:
      #Allow traffic in from phones for TFTP
      pass in on $ext_if from 10.0.0.20 – 10.0.0.30 to any port 69 flags S/SA keep state (max-src-conn 10, max-src-conn-rate 5/5, overload flush global)

      Again, I’m no expert and do not know if any of my posts work at all with more recent versions of FreeNAS.

      Reply
      • Hi, thank you very much for your quick reply and a happy new year. 😉

Leave a Reply Cancel reply

Enter your comment here...

Fill in your details below or click an icon to log in:

Email (Address never made public)

Name

Website

You are commenting using your WordPress.com account. ( Log Out /  Change )

You are commenting using your Facebook account. ( Log Out /  Change )

Cancel

Connecting to %s

Notify me of new comments via email.

Notify me of new posts via email.

Δ