Whether intranet IP access can be managed

[Kris.Say]

Hello, advanced friends
I'm new to OPNsense. Even though I've figured out the basic settings, I can still successfully set up a basic environment through DHCP.
I would like to ask all the experts, if:

There are three devices in the intranet 192.168.1.0/24

A host: 192.168.1.100
B host: 192.168.1.10
C host: 192.168.1.20

Wan
All three hosts can access the Internet

Lan Lan
A host: can SSH to B and C hosts
Host B: Unable to connect to all hosts
Host B: Unable to connect to all hosts

If possible, which function of OPNsense should I use to achieve this plan?
Firewall?

I would also like to ask the experts for their generous guidance, thank you very much.

Because we are using translation software, there may be words that are not clearly expressed, so please don't mind.

[Patrick M. Hausen]

Hosts on a single LAN communicate without going through the firewall. You cannot control traffic inside the LAN network with OPNsense.

A managed switch with filtering capability can do that.

[Kris.Say]

OK, thank you very much for your guidance.