So i have a NoT VLAN (for local only IoT devices that i don't want to communicate with anything, except my Home Assistant instance).
So far i have managed to block traffic to other networks and allow access only to Home Assistant.
I have also managed to somewhat block Internet access:
ping google.com does not provide any results which is fine.
But int the same time:
ping 216.58.213.110 does return results - which is not fine because the things i want to block try to communicate with IPs directly, not domains.
Here is a screenshot of my current rules so far:
The last (bottom) rule allows NoT net to "any", which includes the whole internet. You probably want to delete (or at least disable) that rule.
Oh, that was it. Thank you!
And then, if you don't have other rules below the RFC1918 rule, that rule is effectively useless.
Its only value would be to generate a log entry if you disabled logging of the default block rule.
You could tighten the timeserver rule (protocol-UDP and port-NTP). That's standard.
Ditto for HA. They likely document that...