How to separate subnets from each other

[venomone]

Hello,

i have 3 subnets lets call them:

1. 192.168.10.0/24
2. 192.168.20.0/24
3. 192.168.30.0/24

but currently all clients of all 3 subnets can talk with each other which should not be possibe.
is there a config setting for this or can i only accomplish that by a firewall rule?
clients should only be able to talk on there very own subnet.

Kind regards and thanks for reading

[hbc]

Install three NICs and add each subnet to one NIC or define VLANs and buy an VLAN capable switch.

Then create an alias e.g. named Net_RFC1918 with content:

• 192.168.0.0/16
• 172.16.0.0/12
• 10.0.0.0/8

Then add to each subnet this rule on top:

Code Select Expand


Protocol Source Port Destination Port Gateway Schedule Description
IPv4+6 * * * Net_RFC1918 * * * Block RFC1918 traffic as destination

Now subnets cannot talk to each other (and future private subnets), except you add an exception above this rule. Rules to public IP addresses in existing rulesets won't be affected.

[venomone]

Hello,

thx for your quick answere but for now this has changed nothing so far for me.

[chemlud]

Let's do it the easy way:

You have three interfaces for your 3 subnets. Let's call them LAN, OPT1 and OPT2.

If LAN is  192.168.10.0/24 then put on top of the firewall rules for this interface (ABOVE the allow any any rule)

Block ipv4 source: any port: any destination: 192.168.20.0/24 port:any

and

Block ipv4 source: any port: any destination: 192.168.30.0/24 port:any

After applying the change, you should no longer be able to reach the .20.0 and .30.0 nets from LAN.

Then create comparable rules on the OPT1 and OPT2 firewall rule tabs...

[hbc]

Hello,

thx for your quick answere but for now this has changed nothing so far for me.

Did you add it as BLOCK/REJECT rule?

[venomone]

Yes i did.

[venomone]

Okay, got it working, my mistake was the rule sequence. i moved up the rule and the magic starts to happen

[venomone]

But what i still dont understand is that now all the traffic is blocked also within the same subnet. i want that each client from each subnet can talk to eachother and reach the internet trough the gateway/router.

[venomone]

Okay i already got, that @ all for your help