New user firewall help

[ilium007]

I have a new OPNsense installation with a few VLAN's being given to wireless clients by a Unifi AP.

I am running Unbound DNS on OPNSense that uses DNS over TLS and DHCP gives clients the piHole server for DNS. piHole forwards queries to Unbound DNS on OPNSense to make use of DNS over TLS.

I would like to have clients on the VLAN's use the 192.168.10.4 DNS server but nothing else. The LAN interface have the default firewall rule to accept all from 'LAN net' and the KIDS interface has default rule to accept all from 'KIDS net'.

I cannot work out why DNS requests from the KIDS network (192.168.13.0/24) is being allowed to LAN net (192.168.10.0/24).

Why is the 'Source' 'LAN net' allowing traffic from 192.168.13.0/24?

[ilium007]

Default firewall rules. Enabling / disabling the LAN net DNS rule in screenshot has no effect. KIDS net clients can access any 192.168.10.0/24 subnet address. I know I am misunderstanding some concept here, I just can't work out what. From reading the OPNsense docs the firewall rules apply to ingress traffic to an interface so LAN rules apply from traffic coming into the LAN interface from other interfaces / subnets.

It is as if 192.168.13.0/24 addresses (KIDS) are somehow part of the 'LAN net' definition.

[ilium007]

'LAN' interface is 192.168.10.1/24
'KIDS' interface IP is 192.168.13.1/24

If the default KIDS firewall rule lets all traffic from 192.168.13.0/24 to the KIDS interface 192.168.13.1/24 how are clients on KIDS network able to access any 192.168.10.0/24 resource? I have now confirmed KIDS client can hit a webserver onm 192.168.10.4/24 and ping that host as well.

[ilium007]

I looked at the live query and noticed that DNS traffic is allowed from 192.168.13.51 to 192.168.10.4. The live query lable says "let out anything from firewall host itself". I don't get this. How is it considered "firewall host itself" when the source IP is 192.168.13.51?

[Patrick M. Hausen]

If you allow from kids net to anything, computers on the kids net can reach anything exactly as you specified. Any means literally any - every other connected interface, network, Internet ...

You need to put a deny from kids net to lan net rule above that if they should only reach the Internet and not the other network.

[ilium007]

Ok thanks.