How to isolate one port/subnet

[hushcoden]

I've got 2x LAN ports and 1x WAN port and I'd want to create firewall rules to 'isolate' LAN2 (which is on a differnet subnet than LAN1) in order to allow only Internet access and no access to LAN1, any advice, please?

Tia.

[lfirewall1243]

Creat a fw rule on

LAN1 which is blocking the traffic to lan2

And on LAN2 which is blocking to lan1

[hushcoden]

Creat a fw rule on

And on LAN2 which is blocking to lan1

Just one rule like the attachment ?

[Greelan]

Easiest would be an allow rule on LAN2 interface, source LAN2 net, destination !LAN1 net

This would replace any block rule from LAN2 net to LAN1 net, and any allow rule from LAN2 net to any

Result: anything from LAN2 net to internet is allowed (by above rule), and anything from LAN2 net to LAN1 net is blocked (by default deny rule)

[hushcoden]

Easiest would be an allow rule on LAN2 interface, source LAN2 net, destination !LAN1 net

Sorry, what !LAN1 net means?

[Greelan]

"Not LAN1 net". Put LAN1 net as destination, but check the invert destination box. So the rule will match if the destination is NOT LAN1 net

[hushcoden]

Ahh gotcha  ;D and that's my current LAN2: I have also two default allow rules which I believe OPNSense created - does it look fine?

[Greelan]

As I said above, you don't need the last two. If you keep them, then all traffic from LAN2 net will continue to be able to reach LAN1 net

[lfirewall1243]

Ahh gotcha  ;D and that's my current LAN2: I have also two default allow rules which I believe OPNSense created - does it look fine?

Yep delete the last 2

[hushcoden]

Thanks, but if I delete the last two, the PS4 won't connect to the Internet...  :o

[Greelan]

So the PS4 is in LAN2 net? Does it rely on any services in LAN net, such as a DNS server?

[Greelan]

I am assuming of course you weren't observing this while the PS4 blocking schedule was operating? [emoji23]

[hushcoden]

So, I fixed it by adding DNS servers manually on PS4  ;D

[blackline]

Why can't we just use the following rule:
PASS src GUEST_LAN dst !WAN

This way, if one ever adds a second or third LAN, I don't have to remember to add firewall rules.