@verbal:
As I mentioned above, does that mean that if I have LAN2 and LAN3 as different subnets, do I have to create separate block/pass rules that match for them?
If you have many internal subnets and you want to block access to any of them from the DMZ you have a few choices.
As I said by default everything is blocked. If you add a new interface but don't put any firewall rules on it the only that will be allowed is DHCP (assuming you have set a dhcp server on it). The only exception to this is the LAN interface which has some rules added by default as you can see.
You could add BLOCK rules that have destination LAN* subnet at the top of the list. Traffic coming into the interface will be matched against one of these if is for a local LAN. Once it has matched it will be blocked, no further action is taken on that packet. Then add a rule below the block rules to allow out any traffic you wish to allow.
I have 11 subnets on my home box and adding 10 block rules on an interface is time consuming and makes the firewall rules table harder to read. Instead I have created an ALIAS that contains all my local subnets in a list, I called it LOCAL.
Then I have a single firewall rule that is ALLOW traffic with destination 'not LOCAL'. Much easier to read but doing just that does not allow traffic to the local DNS forwarder, even on the same interface. So I have an additional rule ALLOW traffic with destination LAN(whichever interface this is) subnet on port 53.
I use this on a guest wifi interface. Doing this does not block traffic to the pfSense webgui listening on the WAN so you must add a block rule or add it to the ALIAS if you don't want this.
Steve
wifi2rules.jpg
wifi2rules.jpg_thumb