Allow Public Internet IPv4 Only Without Using "Destination: any"

[wiring8228]

Problem Description:
Internet connectivity works for all LAN clients when using the "Default allow LAN to any rule" in OPNsense.

However, I want to restrict LAN traffic so that clients can access only public Internet IPv4 addresses (e.g. Google) and cannot access the upstream/private networks or other internal VLANs.

I also suspect that the default LAN net → any rule allows LAN clients to access the other VLANs I have configured on OPNsense, which is not desired.

I want the LAN to have Internet access without granting unrestricted access to other internal networks/VLANs.

Expected Behavior:
LAN clients should be able to access all public Internet IPv4 addresses, including services such as Google, while being prevented from accessing private/internal IPv4 networks and other VLANs.

I would also prefer not to rely on multiple explicit block rules for private networks, as this was not necessary in my previous setup with Sophos UTM, where a single rule from LAN to an object like "Internet IPv4" was sufficient to achieve the same behavior.

Actual Behavior:
With the default:

Interface: LAN
Action: Pass
Direction: In
Version: IPv4
Protocol: any
Source: LAN network
Source Port: any
Destination: any
Destination Port: any

LAN clients have full internet access.

However, when changing the configuration to:

Interface: LAN
Action: Pass
Direction: In
Version: IPv4
Protocol: any
Source: LAN network
Source Port: any
Destination: WAN network
Destination Port: any

LAN clients no longer have internet access.

I suspect this is because the destination "WAN network" refers only to the directly connected 192.168.2.0/24 network rather than the public Internet.

Relevant System Information:

OPNsense 26.7.1

Network Topology:
├── Upstream Device: tp-link Archer MR200
│  └── IP: 192.168.2.1
├── OPNsense WAN Interface
│  ├── IP: 192.168.2.2/24 (Static)
│  └── Gateway: 192.168.2.1
├── OPNsense LAN Interface
    └── IP: 192.168.10.1/24

Question:
What is the correct way to configure the OPNsense firewall so that:

• LAN clients can access all public IPv4 addresses on the Internet.
• LAN clients cannot access other private IPv4 networks (in my case VLANs) besides manually specified ones.
• Internet access does not depend on using Destination: any.

Would the recommended approach be to create explicit block rules for the private networks and other VLAN networks, followed by an allow rule for Internet traffic?

Or could Invert Destination be used to achieve this? I don't fully understand how this option works in this context.

For example, would setting:

Destination: WAN network
Invert Destination: enabled

effectively mean "allow traffic to any destination except the WAN network"?

[viragomann]

"WAN network" is not the the internet, but it's just the Subnet defined on WAN interface. It's the equivalent to "LAN network".

To achieve internet only access, I create an alias and add all private network ranges to it, called it RFC1918.
Then I use this in the pass rule as destination with "Invert Destination" checked.
Then this rule permits access to non-RFC 1918 IPs only.

However, remember that this rule don't permit any access to local IPs. Hence you have to add additional rule to allow DNS, NTP, etc. on this interface.

[Patrick M. Hausen]

Why are people all of a sudden using the exact same overspecific template to ask simple questions on this forum? I'm tired of reading through all this nonsense and might not provide answers anymore. Hint: this is not helpful.

"How can I allow a particular local network Internet access without using destination 'any' while blocking access to other local networks?"

Would have been much much better and entirely sufficient.

[nero355]

Why are people all of a sudden using the exact same overspecific template to ask simple questions on this forum? I'm tired of reading through all this nonsense and might not provide answers anymore. Hint: this is not helpful.

+1 :)

I don't like to scroll through stuff that downgrades any monitor/screen to a 320x240 resolution !!!

W-T-F ?!?! :(

[patient0]

Why are people all of a sudden using the exact same overspecific template to ask simple questions on this forum?

I'm sure it's AI generated from a users question.