How to isolate PC on the network from untrusted computers?

[newman87]

Hi,Ι want to block traffic/isolate my PC1 from untrusted PCs (PC2 and PC3) on the network.See image attached of the topology of the network.
So,I have 2 routers, one commercial router(Router 1), and one OPNSense router. The OPNSense router is behind Router 1.
On the OPNSense router is connected the PC1.On Router 1 are connected the UNTRUSTED computers PC2 and PC3.My question is, how to block traffic from  PC1 to Untrusted PC2 and PC3 and vice versa? (PC1 should have only traffic from internet.)
What firewall rules should I use for this or other technologies (like Captive Portal,Web proxy etc)?
Thanks in advance

[lilsense]

if OPNSense is not setup as NET for the connection the the router1, then you can create a firewall rule to block traffic from the Wifi subnet.

[newman87]

Hello,thanks for the reply.I added a firewall rule with (see image attached):
Interface:WIFI
Direction:In
Protocol:Any
Source:Any
Source port:Any
Destination:WIFI Net
Destination port:Any

Is this correct? How can I test it (On linux)? Is there something more I can do to protect my PC from routing from untrusted PCs?
Thanks

[lilsense]

The picture shows PC1 is on WIFI network. I am not sure what those really mean. Also, Is the OPNSense connected to the other router with NAT/WAN port?

Do you have any routing configured?

[newman87]

The picture shows PC1 is on WIFI network. I am not sure what those really mean. Also, Is the OPNSense connected to the other router with NAT/WAN port?

Do you have any routing configured?

The WAN port of the OPNSense router is connected to a LAN port of the Router 1. I have configured nothing at all for this,just inserted the  ethernet cable connecting the 2 routers.

[lilsense]

typically the WAN port is NAT'd which means that the traffic from the other two PC's should not be able to make it to the PC1. Firewall is set by default to block incoming traffic on the WAN interface.

[newman87]

Firewall is set by default to block incoming traffic on the WAN interface.

This is true,WAN has no firewall rules,so it means all traffic is blocked. However,how my devices, connected to the OPNSense router, surf the web?
Thanks

[lilsense]

yes the PC1 can surf the Web since they establish the connection, traffic can find their ways back without an issue.