Project

General

Profile

Feature #1205

VPN: User-based / Group-based firewall rules

Added by Mark Laagland over 6 years ago. Updated 3 days ago.

Status:
Closed
Priority:
Very Low
Assignee:
-
Category:
User manager
Target version:
Start date:
01/19/2011
Due date:
% Done:

0%


Description

Firewall rules on a per-user or per-group basis would be very helpfull.
This means we could limit acces to certain servers on a per-user or per-group basis.

At the moment, this is already possible by setting a specific IP address per user. However, this feels like a dirty hack. Appart from that, it also means only one user can be connected using a specific account at any one time.

True user/group based firewall rules would bring pfSense one step closer to the big guys like Microsoft, which uses a very nice policy system for this.

History

#1 Updated by al all over 3 years ago

+1
some could say that it can be done using more than one openvpn server instances with different client ip settings and different firewall rules applying at each. But the idea of having firewall rules grouped and applied in a per user group basis seems to be very helpful (despite of the fact that some of it can be approached using Aliases).
This feature also seems to have the same goal with [[#3156]]

#2 Updated by Ermal Luçi over 3 years ago

The user based rules are supported if they come from radius.

Locally to pfSense they still need to be implemented.

#3 Updated by Steffen Wagner over 2 years ago

+1
I even have that in my local ZyXEL router... it's a must have do define firewall rules by LDAP / local groups and users.

#4 Updated by Adrien Carlyle 3 days ago

Ermal Luçi wrote:

The user based rules are supported if they come from radius.

Locally to pfSense they still need to be implemented.

Can you give me a brief description of where I need to look to set up radius user based rules today?

#5 Updated by Jim Pingle 3 days ago

  • Status changed from New to Closed

This has been in place since pfSense 2.1. It uses the same syntax as cisco inacl/outacl, for example "permit tcp from any to any", and if you use subnet masks they need to be wildcard style.

Also available in: Atom PDF