Topics

I have a four-port OPNSense box. two WANs and two LANs. LAN1 should access everything, LAN2 should only access LAN2 and both WANs but not LAN1.

LAN2 interface has the following rules:
1. Allow all inbound if destination is NOT "This Firewall" (meant to allow WAN traffic)
2. Allow all inbound if destination is LAN2

Yet, a PC attached to the LAN2 port can ping another PC attached to LAN1. Why is that?

I have two sites (Site A and Site B) both of which are running OPNSense with a site-to-site WireGuard tunnel. Site A has selective routing set up to route all traffic from a subset of LAN clients to use the WG gateway. Site B doesn't need selective routing; WG is only needed to access LAN clients at Site A and all other outbound traffic uses WAN. The setup is done per these instructions https://docs.opnsense.org/manual/how-tos/wireguard-selective-routing.html (with some trial and error modifications) and it works.

In order to make this work, the instructions above state you have to "Disable Routes" in Site A's local peer. For Site B, it is not needed because WG creates its own routes for the allowed IPs stated in its Endpoints setup.

I did all this and everything works. However, after I upgraded both firewalls to 21.7.1, I noticed the upgrade activated the "Disable Routes" setting at Site B. Puzzled, when I tried to uncheck and save, OPNSense said "You have to enable Disable Routes option". Yet, when I look under Site B's Routes -> Status, I see the appropriate routes set up, possibly remnants of the routes that were previously created when the option was set to no.

Why would that happen?

[SETUP:]

For some reason, the (or some) inbound traffic at my OPT1 port is blocked by the firewall "Default deny rule".  OPT1 is connected to a Google Nest Wifi Router. This router is handing out its own LAN subnet IPs to connected wireless clients.

Firewall log for OPT1 shows many blocked entries from the IPs that are on the LAN side of the Google Router, which I would expect to be invisible to OPNSense. But they are not.

SETUP:


AT&T GW -> OPNSense WAN

OPNSense LAN -> Dumb Switch -> A bunch of wired devices & an Orbi in AP mode
All devices here have 192.168.10.0/24 served by the OPNSense LAN DHCP - This piece works fine.

OPNSense OPT1 -> Google Nest Router
192.168.15.10 is the IP OPNSense gives to the Google router
192.168.86.0/24 is the subnet Google passes out to its LAN clients

I have allow-all-inbound-OPT1 FW rules set up in both on the Floating and OPT1 tabs (did that also for LAN)

Still, I see a bunch of the following block entries in the FW log:
Interface: OPT1
Direction: In
Source: 192.168.86.n or 192.168.15.10
Destination: Various WAN IPs
Proto: TCP
Label: Default deny rule

Not sure if it is related, but I see some blocks on the LAN port too but far fewer. I have the same allow-all-inbound rule on LAN. 

Thank you for taking the time.