Messages

Hello.

before i begin i just want to say that i'm a complete beginner and i hope that after this post it will make more sense to me.


i just created 3 separate VLAN for my home network, and i'm not sure what firewall rules i really need or don't need ?

here's the layout.

VLAN 10 Management
 - here in goes my OPNSENSE and my Switch
VLAN 20 Trusted devices
 - here goes my PC
VLAN 30 Guest WIFI
 - here goes an AP ( doesn't know VLAN )

So i want to be able to access the Opnsense and Switch Gui and the Access Point from my pc so that i can manage them...and obviously my pc needs to access the internet.

The Access Point Does not need to talk to VLAN 10 or VLAN 20......( only the internet or am i saying something dumb) ....and everyone that access the AP needs to have internet access

I dont know if VLAN 10 needs any rules or something ? some said it does, because it needs updates, and some say it doesn't because thats within the software so that i can update opnsense....i know the switch would be a file that i download on the website tp link and then upload it in the gui of the switch.

And what about time server, something that opnsense can be a NTP server and provide sync time to all my devices.....does that mean that i need to make a rule on PORT 123 so that every device gets the time or what ? or does my pc get the time because its already on the internet...again im very new to this

these rules is what i already have in mind, but im looking for feedback

VLAN 20

-Rule 1
action: pass
source: my pc ip (vlan20)
destination: vlan 10 net
protocol: TCP
port: 80 + 443

-Rule 2
action: pass
source: my pc ip (vlan20)
destination: ip Access point (vlan30)
protocol: TCP
port: 80 + 443

-Rule 3
action: pass
source: vlan20
destination: any
protocol: any

VLAN 30

-Rule 1
action: block
source: vlan30
destination: vlan20
protocol: any

-Rule 2
action: block
source: vlan30
destination: vlan10
protocol:any

-Rule3
action: pass
source: vlan30
destination: any
protocol: any

Port range : 80 to 443

Which port range is this?

You can state the source port and the destination port. Source should be "any", the destination that one your GUI is listening on. Is it 443?

Also range from 80 to 443 is a bad idea. You can create an alias and add both ports to it. So the rule covers 80 + 443.

Also ensure that the new interface is selected in System: Settings: Administration > Listen Interfaces.

Yes its listening om 443

Im not comfortable making aliases yet, im still new to this, but i will take a look at it tonight, or i change the rule in the firewall

And i will also look into listen interfaces option. Because i dont think i did that.

I did apply a firewall rule and still nothing happend

I tried it before the rule and after

Action: pass
Interface: emergency exit
Direction: in
Protocol tcp
Port range : 80 to 443
Source: any
Destination: any
Test rule

Hello everyone,

I got this lenovo m720q tiny with a 4 port intel nic and installed opnsense on it.

I already assignd the WAN and LAN interface, but eventually i want to delete the LAN interface and move it to VLAN. So i wanted to create an emergency exit on a new interface thats not going to be used unless i lock myself out from the LAN

So i assigned the new interface on a different port, after that i enable it and gave it a static ip, then i set up dhcp for that new interface.

But when i look in the menu assignment i see that the plug on that new interface stays red and te other WAN and LAN are green ( im building it offline for now so WAN is not plugged id)

And even when i plug my pc in that new port i see it get connected but i cant visit the opnsense gui...the page stays loading for a while....and even when i try to ping it from my pc it gets stuck at the first byte.

The LAN interface ip i got that on 192.168.1.1
The Emergency exit port on 192.168.99.1

So i dont know what im doing wrong or missing and can someone help me ?

Thanks!