I've got 2x LAN ports and 1x WAN port and I'd want to create firewall rules to 'isolate' LAN2 (which is on a differnet subnet than LAN1) in order to allow only Internet access and no access to LAN1, any advice, please?
Tia.
Creat a fw rule on
LAN1 which is blocking the traffic to lan2
And on LAN2 which is blocking to lan1
Quote from: lfirewall1243 on March 30, 2021, 09:35:24 PM
Creat a fw rule on
And on LAN2 which is blocking to lan1
Just one rule like the attachment ?
Easiest would be an allow rule on LAN2 interface, source LAN2 net, destination !LAN1 net
This would replace any block rule from LAN2 net to LAN1 net, and any allow rule from LAN2 net to any
Result: anything from LAN2 net to internet is allowed (by above rule), and anything from LAN2 net to LAN1 net is blocked (by default deny rule)
Quote from: Greelan on March 31, 2021, 01:12:33 PM
Easiest would be an allow rule on LAN2 interface, source LAN2 net, destination !LAN1 net
Sorry, what
!LAN1 net means?
"Not LAN1 net". Put LAN1 net as destination, but check the invert destination box. So the rule will match if the destination is NOT LAN1 net
Ahh gotcha ;D and that's my current LAN2: I have also two default allow rules which I believe OPNSense created - does it look fine?
As I said above, you don't need the last two. If you keep them, then all traffic from LAN2 net will continue to be able to reach LAN1 net
Quote from: hushcoden on March 31, 2021, 02:39:14 PM
Ahh gotcha ;D and that's my current LAN2: I have also two default allow rules which I believe OPNSense created - does it look fine?
Yep delete the last 2
Thanks, but if I delete the last two, the PS4 won't connect to the Internet... :o
So the PS4 is in LAN2 net? Does it rely on any services in LAN net, such as a DNS server?
I am assuming of course you weren't observing this while the PS4 blocking schedule was operating? [emoji23]
So, I fixed it by adding DNS servers manually on PS4 ;D
Why can't we just use the following rule:
PASS src GUEST_LAN dst !WAN
This way, if one ever adds a second or third LAN, I don't have to remember to add firewall rules.