I'm planning a network with >100 LAN networks on VLANs. Every network needs access to DNS, NTP and possibly other services on the firewall.
The easy solution is of course, to create a floating rule, so that any firewall interface except WAN(s) can be reached from any network. But that would allow nosy users and internal attackers to easily get an idea of the topology of the network. Alternatively, creating more specialised rules for every interface would be a pain. The best I have come up with so far is to create an otherwise unused interface, have all the firewall services listen on that and to create one floating rule for everyone to access the services there. That adds a bit of fiddling with DHCP.
Is there a more elegant way, i.e. secure and low maintenance, to provide services for every network on the FW yet keep the networks seperate?
Instead of an unused interface, use a loopback interface.
I've added all my interfaces to an interface group, called it "Internal", where I've defined common rules for DNS, NTP and alike.
And yes I've forwarded DNS and NTP requests to the loopback address. This means, you can also use the interface group in port forwarding rules.
Quote from: viragomann on Today at 04:56:14 PMAnd yes I've forwarded DNS and NTP requests to the loopback address. This means, you can also use the interface group in port forwarding rules.
I have been doing the same. One minor gotcha I encountered, some pre-existing rules allowing access to locally hosted services by way of an RFC1918 alias, had to be updated. Otherwise it seems a robust technique and served as a workaround for issues I've had in the past where a service was just not listening on all interfaces despite setting it as such. This wasn't in opnsense BTW.
Quote from: mooh on Today at 04:34:32 PMAlternatively, creating more specialised rules for every interface would be a pain.
TIP : Create those Firewall Rules and then clone them to another Interface and see what happens! ;)
TL;DR : Not that much work if you do it the right way!
Quote from: viragomann on Today at 04:56:14 PMI've added all my interfaces to an interface group, called it "Internal", where I've defined common rules for DNS, NTP and alike.
I wonder, if I could also do some more rules on such a group like block RFC1918, allow internet and do those as non-quick. Then I could create some local quick allow rules on the single interfaces...