Messages

@chemlud
@jp0469

Thank you. I believe I got this working.

Thanks, I moved that to the top. How about rest of IOT and LAN rules look?

I have created a LAN and VLAN-IOT setup for my home office.
I simply want VLAN-IOT subnet to just have internet access but not the LAN access.
I am not an IT person and not sure the rules I created, with help of the Opnsense forum and internet, are valid and protects my network.

I would appreciate any feedback.

LAN Rules


IOT Rules


Aliases

I saw the same thing, not sure if IPS crashed but WAN stopped getting IP address and it shoed in dashboard WAN IP 0.0.0.0. This is after running speed test.
I installed 21.7 and after some updates I am at 21.7.7 and I will stay here until things get better.

Your link does not work,
but this guide helped me:
https://homenetworkguy.com/how-to/configure-intrusion-detection-opnsense/#_

Thanks, I used the same link. I updated my link.
Did you use LAN or WAN  setup? Did you make two policies, one for Alert and one for Drop?

Your link does not work,
but this guide helped me:
https://homenetworkguy.com/how-to/configure-intrusion-detection-opnsense/#_

Thanks, I used the same link. I updated my link.
Did you use LAN or WAN  setup?

I am planning to follow this guide to enable Intrusion Prevention System using this guide. Will this give me basic protection?

https://homenetworkguy.com/how-to/configure-intrusion-detection-opnsense/#_

I static mapped a MAC address from DHCPv4 --> Leases.
I don't see this MAC any where in here but the device is functioning.
How do I undo the static mapping?

1. Just create a firewall rule like you did for the pihole? Unless you are also talking about broadcast discovery, in which you will need a plugin like udpbroadcastrelay

2. Host(s)

Thank you

I am setting up a new SOHO for my own use and I'm trying to move from my existing setup of one LAN for my home user and a VLAN for the IoT devices.
All my gears with static IP are residing in the LAN.
The devices are
Opnsense router: 192.168.4.1
Unifi 60W managed switch:192.168.4.2
Unifi AP-AC lite: 192.168.4.3
PiHole: 192.168.4.4
Unifi controller: 192.168.4.6

IoT VLAN20: 10.0.20.0/24
User VLAN 10.0.10.0/24

My goal is to keep all the devices and IPs as is. I already created a new VLAN10 where all the users laptops and pcs will be using VLAN10.

I have already created rules to block VLANs to access each other and LAN.

I created an alias for the Piholes and a allow rule to have my VLAN access it. I also have a rule to block any other DNS services for the VLANs.

I need to figure out 2 things:
1. How do I keep the printer in the LAN and have VLAN users share it?
2. For creating 2 Piholes alias what is the "Type" in the alias window? Is it hosts or networks?

For Type should it be Hosts in the dropdown or Networks?

My DNS server is Pihole in 192.168.4.0/24 address.

My main concern is to use the devices that already have static IPs in 192.168.4.0/24  network. I don't want to change the IP addresses to new Vlan10's IP.
Not only Pihole but devices like, printer, AP-AC lite, switches etc that are 192.168.4.0/24 static addressed.
If I can keep these 10 192.168.4.0/24 and still access from my VLAN10 I am ok with that.

This is what I'm trying to setup but I think I need to do something in the firewall to allow PiHole DNS and other devices from Lan to VLAN10 access.

LAN 192.168.4.0/24 -MGT
VLAN10- 10.0.10.0/24 -0 family use, laptop, PC etc
VLAN20- 10.0.20.0/24 - IoT
PiVPN 192.168.4.0/24 subnet. I want to open port for 51826 in the firewall and port forward to PiVPN IP address.

I have the following setup using static IP in 192.168.4.0/24 network - Route, Unifi switch, 2 Unifi AP-AC Lite access points, Pihole, printer.
2X Unifi access points have already been setup with Vlan10 & Vlan 20 profile. One SSID for home use another for IoT.

I want to use the Pihole from my management subnet to Vlan 10 for it's DNS and ad blocker. The Lan and Vlan10 can talk to each other, I don't need to restrict this. I'm trying to make it simple.
IoT Vlan20 will use DNS 8.8.8, no need for PiHole access.

Now, what would be the most simplest way i Can implement this? I probably need some firewall rules but not sure how to.

I have a LAN that I want to use AdGuard for DNS using any family shield service. And a  VLAN to use 8.8.8.8.
Is that possible and how?

Don't know what hardware you're using but my X86 running Opnsense never needs any rebooting or shows symptoms you described.
It only gets rebooted when I apply firmware updates.