Firewall rule guidance

[jcdick1]

I have three VLANs configured, connecting to three interfaces on my opnsense, and I'm trying to isolate one of them so that no traffic comes in or out, and hosts can only get DNS from opnsense and talk to each other.  No access to or from other VLANs or the Internet at large.  We'll call them A B and C.  I'd like to isolate C.

I configured a firewall rule as follows:

Interface: C
Direction: In
Protocol: Any
Source: Any
Destination: C net
Destination port range: Any

But I was still able to access web services on the hosts at IP addresses in that subnet from my primary VLAN.

Any guidance is appreciated.