@BigA said in VLAN/Firewall Access for Admin Only on any of the firewalled Vlans:
to access Pfsense from another area that only has access to the internet (PrivateIP Block rule)
Rules are evaluated top down, first rule wins, no other rules are evaluated. If what your asking is how to allow some device or network that is limited to talking to other rfc1918 address (ie your other networks)..
Just create a rule that allows who (what IP or network) to talk to your pfsense gui.. Be it the pfsense address on this network, or another pfsense IP, the built in alias "this firewall" could be used to be any IP address.
So for example here is example locked down rule that prevents access to pfsense IPs other than specific (dns, icmp, ntp) etc.. And blocks all other access to any other rfc1918 address space.
rules.jpg
So while these rules only allow this network "test subnets" which is 192.168.200/24 in my case.. To access icmp, dns and ntp on pfsense IP address in this network 192.168.200.253 for me.
It blocks access to any other pfsense IP and rfc1918... I could if I wanted create say a rule that allows access to the pfsense IP on this network "test address" on the port my webgui listens on 8443
allowrule.jpg
This rule could be adjusted for your needs, only say a specific IP on this network, say 192.168.200.x for my network. if you want multiple ports say 80,443,22 etc.. you could create an alias that contains these ports. Or just create multiple rules.
As long as the rule(s) are above where you block rfc1918 you would be able to access the web gui.
Rules are evaluated in order, so if you don't hit a rule that matches be it allow or deny then you fall all the way through to the bottom and are denied by the default deny rule (that isn't shown in the gui).
