Help me make sense of these firewall rules please!

[teddybearnemo]

Hello.

before i begin i just want to say that i'm a complete beginner and i hope that after this post it will make more sense to me.


i just created 3 separate VLAN for my home network, and i'm not sure what firewall rules i really need or don't need ?

here's the layout.

VLAN 10 Management
 - here in goes my OPNSENSE and my Switch
VLAN 20 Trusted devices
 - here goes my PC
VLAN 30 Guest WIFI
 - here goes an AP ( doesn't know VLAN )

So i want to be able to access the Opnsense and Switch Gui and the Access Point from my pc so that i can manage them...and obviously my pc needs to access the internet.

The Access Point Does not need to talk to VLAN 10 or VLAN 20......( only the internet or am i saying something dumb) ....and everyone that access the AP needs to have internet access

I dont know if VLAN 10 needs any rules or something ? some said it does, because it needs updates, and some say it doesn't because thats within the software so that i can update opnsense....i know the switch would be a file that i download on the website tp link and then upload it in the gui of the switch.

And what about time server, something that opnsense can be a NTP server and provide sync time to all my devices.....does that mean that i need to make a rule on PORT 123 so that every device gets the time or what ? or does my pc get the time because its already on the internet...again im very new to this

these rules is what i already have in mind, but im looking for feedback

VLAN 20

-Rule 1
action: pass
source: my pc ip (vlan20)
destination: vlan 10 net
protocol: TCP
port: 80 + 443

-Rule 2
action: pass
source: my pc ip (vlan20)
destination: ip Access point (vlan30)
protocol: TCP
port: 80 + 443

-Rule 3
action: pass
source: vlan20
destination: any
protocol: any

VLAN 30

-Rule 1
action: block
source: vlan30
destination: vlan20
protocol: any

-Rule 2
action: block
source: vlan30
destination: vlan10
protocol:any

-Rule3
action: pass
source: vlan30
destination: any
protocol: any

[viragomann]

VLAN 10 Management
 - here in goes my OPNSENSE and my Switch
VLAN 20 Trusted devices
 - here goes my PC
VLAN 30 Guest WIFI
 - here goes an AP ( doesn't know VLAN )

On VLAN20 you might want to allow any for your PC.
So you would need an allow any-to-any rule like it's predefined on LAN.

I dont know if VLAN 10 needs any rules or something ? some said it does, because it needs updates, and some say it doesn't because thats within the software so that i can update opnsense....i know the switch would be a file that i download on the website tp link and then upload it in the gui of the switch.

In this case, there is no rule needed on VLAN10, expect for NTP if the swicht request it.

For internet access on VLAN30:
You didn't mention, if you use IPv4 only or IPv6 as well. For IPv4 I created an alias and added all RFC 1918 networks to it (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
The I use this alias in the pass as destination with "invert" checked. So
interface: VLAN 30
action: pass
protocol: any (if you want)
source: vlan 30 net
invert destination: checked
destination: RFC1918
dest. port: any (if you want)

Assuming your OPNsense provides the DNS and NTP, you additionally need a rule for these.
interface: VLAN 30
action: pass
protocol: TCP/UDP
source: vlan 30 net
destination: This firewall
dest. port: domain

interface: VLAN 30
action: pass
protocol: TCP/UDP
source: vlan 30 net
destination: This firewall
dest. port: NTP

To ensure, that the client use your OPNsene for these service, you can also redirect this traffic to it.
Destination NAT rule:
interface: VLAN 30
protocol: TCP/UDP
source: vlan 30 net
destination: any
dest. port: 53
redirect target IP: 127.0.0.1
redirect target port: 53

And the same for NTP, port 123.