forum.ipfire.org

Have you noticed the DNSSEC status when your having connection failures? DNSSEC status can be found on STATUS>NETWORK(EXTERNAL) page. Suspect your having rDNS failures.

I'm running green, blue, orange. You should be able to get what you want with a few rules.

The default policy is a handy place to start planning.
https://wiki.ipfire.org/configuration/f ... ult-policy

Noticed my steam downloads run at the max rate for my cable plan. Did find that Steam did not pick the closest servers automatically.

Read up a bit on this and see your point that blocking ping is just not a good idea.

Well just for grins I ran the Shields up test, surprisingly it fails on ping. GRC Port Authority Report created on UTC: 2019-07-07 at 21:29:21 ALL PORTS tested were found to be: STEALTH. TruStealth: FAILED - ALL tested ports were STEALTH, - NO unsolicited packets were received, - A PING REPLY (ICMP ...

Wow 8 watts is low power. Checked my HP 6005 SFF with a kil-a-watt meter, 56 watts. Guess that's not terribly efficient but not to bad about $4 a month to run here.

Yep, IPFire is my firewall. Blocking, limiting and permitting access is what a firewall all about. Ipfire has allot of controls which i like plus mine is configured with three networks, blue, green and orange to separate my devices. Run it on an old PC with 4 nic's, a couple of bridged wireless devi...

Another option is older HP compaq SFF box's off Ebay. Hundreds of these hit the market from corporate refresh cycles for less than the price of a Raspberry. I'm running AMD's that are only venerable to spectre 1 and 2 which are mitigated, much better than Intel's offerings.

i stopped using my ipfire firewall for DNS many years ago after they made a change that broke my host file I was using to block ADs, malware, etc... my ipfire points to "the google" DNS servers. my ipfire's DHCP gives out one internal DNS server address which is an internal (green side) rpi running...

After core update 132 cloudfare DNS has problems and perhaps others DNS servers as well but its the only one I know for sure does not play well. I'm using Verisign DNS servers with no apparent problems. Submitted a bug for this.

Perhaps the Game has coded in DNS servers addresses and your firewall DNS block rules are are stopping it. Try disabling your DNS blocks. Also from your drawing the ipfire Nic-1 DNS info seems odd, shows it pointing to itself 192.168.2.1, also has DNS set to auto? What does Ipfire's gui show for DNS...

Cloudfare and the new IPS don't play well together at the moment, resulting in some sites getting blocked and rDNS fails. Another indicator is ping by name stops working to the blocked sites. Perhaps this issue is affecting your configuration. I set my rules to block all external DNS access from Gre...

Already tried the Rule method via GUI, and it did not work, so went with the iptables method. But, that's not working either. Just tested it and I can block an specific IP with a rule. Source: Standard Networks GREEN Destination Address: xxx.xxx.xxx.xxx I'm also blocking all DNS traffic to RED and ...

Could make a firewall rule to block a single ip easy enough.

Here's another way that allows for blocking url's via dns. If you go this route I've noticed that the IPS service needs to be stopped while setting this up.
https://github.com/sfeakes/ipfire-scripts

Thanks for the that explanation, makes sense. Agreed, 108MB (Talos) compared to 2.3MB (EM), big difference. Now I'll switch back to Talos :) One thing I noticed about the Talos rules are that while there large files they have very few actual sub-rules selected if you hit the "show" target. So you h...