Firewall Zones

[pongafence]

Hi all,

Was wanting to know if the concept of "firewall zonies" has been or is going to be implemented into OPNsense.


Thanks,
D

[fabian]

no and it won't because this is outdated (if you are talking about red, orange, green and blue zones like in ipfire). In OPNsense, any interface (virtual or physical) can be a wan uplink, dmz or an internal network. You can also group some interfaces for example your internal LAN interfaces.

[franco]

For all intents and purposes, zones are interfaces in OPNsense. The definition is a bit fuzzy because interfaces can also be physical interfaces, but in general all interfaces in the menu with [NAME] or in the firewall rules tabs are zones.

Bridges make this a bit more complicated as well. But all in all it's just a naming thing that's hard to change without hurting language translations, documentation and ease of use for people used to M0n0wall, pfSense and OPNsense.


Cheers,
Franco

[pongafence]

Hi,

Thanks for that.  Funny you should mention it about being dated.

Anyway, more along the lines of how the likes of Fortinet, Cisco, CheckPoint etc.  How they create "Zones", then assign "interfaces", be it physical or virtual, and group them together.  And then using firewall rules that applied to "intra-zone" traffic, but still allow all traffic within a "zone" to flow without rules.

[franco]

You may have misinterpreted Fabian's comment about IPFire. It was not meant to include the vendors you mentioned.

Yes, an interface in OPNsense is a zone. You can change the underlying physical interface in the interfaces assignment page.


Cheers,
Franco

[fabian]

You may have misinterpreted Fabian's comment about IPFire. It was not meant to include the vendors you mentioned.

Probably yes - if somebody is talking about zones, I usually understand that this default policies are meant:
https://wiki.ipfire.org/configuration/firewall/default-policy

[mimugmail]

If you want to compare with Cisco IOS zones you should use floating rules.

[pongafence]

Ah yeah okay.  I was thinking about using Floating instead.  But then wasn't too sure if it'd achieve the same sort of thing.

[franco]

If we talk floating you can also do firewall groups ;)


Cheers,
Franco

[mimugmail]

Yep, look at floating or firewall groups, which way fits you best :)