The most glaring problem with the rules in your original screenshot I can spot right away is setting WAN_1 net
as the destination for rules that are supposed to grant internet access.
Think about what X net
and X address
actually means for any given interface X
in pfSense. For example, assume the interface LAN
is assigned the address 192.168.0.1
with the prefix /24
. Then LAN address
will be the same as 192.168.0.1/32
and LAN net
will be the same as 192.168.0.0/24
.
If you look at the subnet mask of your WAN_1
interface (Status → Interfaces), you’ll see that it doesn’t cover the entire internet, i.e. it’s not 0.0.0.0
(which would be /0
in terms of prefix length). So with WAN_1 net
you are only covering a very small part of the internet, specifically the routers of other customers of your ISP. Naturally, addresses like 1.1.1.1
are not part of that network and your rule thus doesn’t allow access to them.
If you want a rule that allows access to the general internet, you will have to select something much broader for the destination. A bad practice which unfortunately many people apparently still do is to use any
for the destination, which of course also allows access to all local networks, which is usually not intended. People would then precede this rule with rules blocking access to the individual local networks. But this has the drawback that if you ever added a new local network, you would have to make sure to update all interfaces’ rules to reflect that change, which is a lot of effort and has security implications if you forget to do it.
A much better approach is, as already suggested in this thread, to explicitly allow access to all destinations that are not part of any local network. For that, you create an alias containing all the addresses that could possibly be used in local networks. For IPv4, that corresponds to
Then you use this alias as the destination, but invert the match.
I personally never use reject rules in my configurations. pfSense by default rejects anything that you don’t specifically allow with a rule anyways, so this is in my opinion the best philosophy.