DMZ to DNS on DMZ interface not working

[0zzy]

Hey together,

I configured a DMZ in my vlan.

everything works except the firewall rule for DNS which should be the Interface Address.

I Use Unbound for everything.

I set an ACL in Outbound for it.
My Firewall Rules are:

Protocol   Source   Port   Destination   Port   Gateway   Schedule      Description
IPv4 TCP/UDP   LANDMZ net   53 (DNS)   dmz_ns    53 (DNS)   *   *      Forward DNS       
        IPv4 ICMP   LANDMZ net   *   *   *   *   *      Allow ICMP to OPNsense       
        IPv4+6 *   LANDMZ net   *   RFC1918    *   *   *      Block LANDMZ to internal       
        IPv4+6 *   LANDMZ net   *   ! RFC1918    *   *   *      Allow access to Internet and block access to all local networks       
        IPv4 *   LANDMZ net   *   FLUX_IPs    *   *   *      Allow to admin PC only       
        IPv4 *   LANDMZ net   *   *   *   *   *      Block all other

Why can't the dmz reach the DNS?
I'm confused about that.

[Patrick M. Hausen]

The source port is not 53 but any.

[0zzy]

@Patrick M. Hausen,
oh my god.... it works...
you are my hero of the day ;)
Thank you!

[EricPerl]

A few comments on the rules (reformatted), inline

My Firewall Rules are:

Code Select Expand

AB   Protocol     Source     Port Destination Port Description
A  IPv4 TCP/UDP LANDMZ net *    dmz_ns      53   Forward DNS               # Corrected by Patrick. Based on preamble, LANDMZ address could have been used for dest
A  IPv4 ICMP    LANDMZ net *    *           *    Allow ICMP to OPNsense   
B  IPv4+6 *     LANDMZ net *    RFC1918     *    Block LANDMZ to internal  # Typically not useful unless there's a more general allow later,
                                                                           # like the following rule if the destination was any.
A  IPv4+6 *     LANDMZ net *    !RFC1918    *    Allow access to Internet and block access to all local networks
                                                                           # The above rule doesn't block anything...   
A  IPv4 *       LANDMZ net *    FLUX_IPs    *    Allow to admin PC only    # Isn't the Block RFC1918 rule getting in the way?   
B  IPv4 *       LANDMZ net *    *           *    Block all other           # Without this, the 'default deny / state violation' would be used...


AB is Allow or Block.
Wrt the !RFC1918 rule, the meaning is Allow all traffic to 'any destination except private networks' (iow, only the Internet).
It's an allow rule. It can't block anything.
Importantly, because it does not apply to local/private traffic, such traffic can be allowed by other rules below.