where should i create allow firewall rules (source VLAN or destination VLAN) ?

bkalem

Hello,

(02) two VLANs connected to physical switch and routed by pfSense netgate 4100 :

VLAN 10: 192.168.10.0/24
VLAN 20: 192.168.20.0/24

i want to allow only VLAN 10 to communication with VLAN 20

could you please help to understand where the allow firewall rule need to be created ?
vlan pfsense.JPG

in source VLAN 10 : i create the allow firewall rule
VLAN_10_NETWORK -> VLAN_20_NETWORK
in destination VLAN 20 : i create the allow firewall rule
VLAN_10_NETWORK -> VLAN_20_NETWORK
in both source VLAN 10 & destination VLAN_20 : i create the allow firewall rule
VLAN_10_NETWORK -> VLAN_20_NETWORK

Thank you per advance for your help

the other

@bkalem
hey there,
you create rules at the ingoing interface...
So:
need to get from VLAN A to VLAN B...set rule pass--Source VLAN A---Destination VLAN B------Ports: any (or what you need) on interface VLAN A.

Should do the trick...
:)

johnpoz

@bkalem Traffic is evaluated as it enters the pfsense interface from the network attached.

if you want vlan 10 to be able to talk to something in vlan 20.. Pfsense see the traffic as it enters the vlan 10 interface from vlan 10, so this is where the rule would go to allow what you want into the destination (vlan 20 net)..

Unless you create floating rules, pfsense never evaluates traffic as it exits an interface into a network.

There is no need for a return rule in vlan 20, since the return traffic from vlan 20 to vlan 10 would be allowed by the state that pfsense creates when it allowed the traffic on vlan 10.

Think of pfsense as a building, your standing in middle of the building. As traffic tries to enter a door from outside the building is where the rules would be evaluated..

if someone tries to enter your building (pfsense) from vlan 10 into the vlan 10 door, this is where you would allow them to enter or not.. Lets say that traffic was going to vlan 20, then you would allow, but maybe it trying to go t vlan_12 so you deny that.. But the rules are placed on the interface where the traffic would enter the building (pfsense)

Keep in mind rules are evaluated top down, first rule to trigger wins, no other rules are evaluated.