Config Two completely separate home networks with one shared internet connection

[Jjabba]

Me and my neighbor wants to share internet connection. I run opnsense on hardware with 3 Ethernet ports so basically the idea is to use port A as WAN, port B as my LAN (I.e 192.168.1.*) and port C as my neighbors LAN (I.e 192.168.10.* or 10.0.0.*)

Both LAN 1 and LAN 2 needs to be able to access internet provided via the WAN port.
Furthermore, no communication should be allowed between lan 1 and lan 2.
I.e no samba file shares, bonjour discovery or other home network features should bleed over from one LAN to the other.

Would this be possible to achieve using OPNsense?

[chemlud]

With correct setup of firewall rules/config you can achieve isolation of two subnets on two different interfaces. But you share ONE piece of hardware, with all risks (logs are accessible, box might get compromised one way or the other, which DNS to use, who get's how much bandwidth, etc. etc. etc.).

if you are really close with your neighbor (now), you might get this to work. But it might be tricky in the long run, my opinion... ;-)

[Jjabba]

Great! I am not very close with my neighbor but I’m on a symmetrical gigabit fiber connection so I hope that will make up for it. 

If anyone has more hands on experience of exactly what type of rules I need to set up that would be helpful.

[Mks]

Hi,

for sure you can do that. It‘s possible with multiple ways, physical interfaces or via VLANs.

However, who owns the box has full control over the traffic, question is if your neighbour trusts you

br

[Jjabba]

  The box would be under my professional supervision so that's not a problem. I just got it up running and configured it to run the separate LANs on the different physical ports. Now how should I go about blocking of the two LANs from each other? I'm guessing it's in the firewall section of the OPN web configuration interface...

[banym]

Hi,

basically setup the block rules on each interface.
You can follow the this guide and adapt it to your networks: https://docs.opnsense.org/manual/how-tos/guestnet.html

[Mks]

Hi,

if you have separate LANs, then basically if you do not define an allow rule access from one LAN to another is not possible. But we do not know your setup in detail so any advice is a guessing game ;-).

br

[Jjabba]

I've now ran the setup for some time and currently I'm experiencing some 'bleedover'.
In OS X, my neighbours SMB share is listed under 'shared' in my finder windows.

Here are (some) of my DHCPv4 leases

Interface	IP address	MAC address	Hostname
MYLAN	192.168.1.12	00:00:00:00:00:d2	access point
MYLAN	192.168.1.20	00:00:00:00:00:7b	amazon
NEIGHBORLAN	192.168.100.11	00:00:00:00:00:c0	access point
NEIGHBORLAN	192.168.100.16	00:00:00:00:00:d4	DESKTOP-PC
NEIGHBORLAN	192.168.100.18	00:00:00:00:00:46	iPhone-X

Firewall rules for MYLAN

Protocol	Source	Port	Destination	Port	Gateway	Schedule	Description
IPv4 *	MYLAN net	*	*	*	*	*	Default allow LAN to any rule
IPv6 *	MYLAN net	*	*	*	*	*	Default allow LAN IPv6 to any rule

Firewall rules for NEIGHBORLAN

Protocol	Source	Port	Destination	Port	Gateway	Schedule	Description
IPv4+6 *	*	*	MYLAN net	*	*	*	Block all traffic to MYLAN
IPv4 *	*	*	*	*	*	*	Default allow LAN to any rule
IPv6 *	*	*	*	*	*	*	Default allow LAN IPv6 to any rule

Does anyone know how I might block samba-detection bleed over?

[banym]

Check if you get tricked by IPv6. You allow everything from your neighbor to any WITH IPv6.

[Mks]

According to your config you (MYLAN) has access to everything, at least on IPv4.

Br

[banym]

Oh yes, the block rule on your interface is missing.

[Jjabba]

Thanks! That did the trick, I added the same IPv4+6 blocking rule for traffic from MYLAN to NEIGHBORLAN and now I have no more bleed over from samba shares. 

However this has made me realize something is flawed in my understanding of how the firewall operates. I am fairly familiar with how TCP/IP works, including the difference between UDP and TCP protocols etc.
My initial understanding made me reason like this:
- by blocking NEIGBORLAN to send any traffic to MYLAN, any attempt to send _requests_ AND _respond to requests_ would be blocked.
Obviously that wasn't the case.
My new Hypothesis is that:
- the bleed-over occurred because my computer on MYLAN sent some type of samba-broadcast request, which made it to NEIGBORLAN where the firewall allowed some device to "answer" that request (as it was instigated by a device on MYLAN).

Code: [Select]

MYLAN                                NEIGHBORLAN
rule in effect
CPU1           <----blocked----<     CPUX
CPU1               [nothing]         CPUX

rule _not_ in effect (bleed over)
CPU1           >----allowed---->     CPUX
CPU1           <----allowed----<     CPUX
Can someone confirm?

[Mks]

Hi.

OpnSense works on per Interface level (incomin).
Search a bit for incoming rules this is how it works,

Br

[Jjabba]

I did some reading but frankly it didn't make it more clear to me. I guess my problem understanding this stems from how the rule I set up for NEIGHBOR Lan above clearly asks me to provide Source as well as Destination. This IMO implies that a blocking rule for any traffic with destination 'MYLAN' would be a valid configuration but from what i read that is then an 'outbound' firewall block which is not how OPNsense operates... 

[Mks]

Hi,

Firewall rules control what traffic is allowed to enter an interface on the firewall. Once traffic is passed on the interface it enters an entry in the state table is created.

You should read the rule like this:

(MYLAN) Interface
IPv4 *   MYLAN net   *   *   *   *   *   Default allow LAN to any
Every IPv4 packet which arrives (incoming) at “MYLAN Interface” is checked if
-IP is within the MYLAN range,
-Port *
-Destination *

if everything matches the paket is allowed.

Ok?

br