Hello,
i have 3 subnets lets call them:
1. 192.168.10.0/24
2. 192.168.20.0/24
3. 192.168.30.0/24
but currently all clients of all 3 subnets can talk with each other which should not be possibe.
is there a config setting for this or can i only accomplish that by a firewall rule?
clients should only be able to talk on there very own subnet.
Kind regards and thanks for reading
Install three NICs and add each subnet to one NIC or define VLANs and buy an VLAN capable switch.
Then create an alias e.g. named Net_RFC1918 with content:
- 192.168.0.0/16
- 172.16.0.0/12
- 10.0.0.0/8
Then add to each subnet this rule on top:
Protocol Source Port Destination Port Gateway Schedule Description
IPv4+6 * * * Net_RFC1918 * * * Block RFC1918 traffic as destinationNow subnets cannot talk to each other (and future private subnets), except you add an exception above this rule. Rules to public IP addresses in existing rulesets won't be affected.
Hello,
thx for your quick answere but for now this has changed nothing so far for me.
Let's do it the easy way:
You have three interfaces for your 3 subnets. Let's call them LAN, OPT1 and OPT2.
If LAN is 192.168.10.0/24 then put on top of the firewall rules for this interface (ABOVE the allow any any rule)
Block ipv4 source: any port: any destination: 192.168.20.0/24 port:any
and
Block ipv4 source: any port: any destination: 192.168.30.0/24 port:any
After applying the change, you should no longer be able to reach the .20.0 and .30.0 nets from LAN.
Then create comparable rules on the OPT1 and OPT2 firewall rule tabs...
Quote from: venomone on November 26, 2019, 02:43:21 PM
Hello,
thx for your quick answere but for now this has changed nothing so far for me.
Did you add it as BLOCK/REJECT rule?
Yes i did.
Okay, got it working, my mistake was the rule sequence. i moved up the rule and the magic starts to happen
But what i still dont understand is that now all the traffic is blocked also within the same subnet. i want that each client from each subnet can talk to eachother and reach the internet trough the gateway/router.
Okay i already got, that @ all for your help