2 LANSs - need mutual exclusivity

lastat

I have dug around quite a bit and I think I don't understand because from what I have read:

10.0.20.x/255.255.255.0
and
10.1.20.x/255.255.255.0

Should not be able to see each other… but my 10.1s can see my 10.0s - but not visa versa! i.e. a computer on 10.1 can go to a web page/server on 10.0 but a computer on 10.0 cannot get to a webpage/server on 10.1. Same with SSH etc.

What I want is mutual exclusivity.

ALL 10.1.20.x traffic goes through pfSense LAN. The pfSense WAN goes to a LAN port of 10.0.20.x

I have attached a network diagram.

Also, the current router connected to ISP/CableModem must be first in line.

Thoughts on how to establish this total isolation of 10.1?
![Network Diagram.png](/public/imported_attachments/1/Network Diagram.png)
![Network Diagram.png_thumb](/public/imported_attachments/1/Network Diagram.png_thumb)

viragomann

So just exclude the 10.0.20.x/255.255.255.0 from the allow rule on pfSense LAN interface. To do so, check "invert" at destination and select "WAN net".
This presumes that the pfSense WAN is in 10.0.20.x/255.255.255.0 and the mask is set correctly.

lastat

I added a new LAN rule, on top, blocking LAN Net from 10.0.20.0/24 - that works… but has a major hole. An Admin on 10.1 can simply disable this rule and then access 10.0.

So now that I think through it, pfSense won't be the solution as 10.0 needs to consider all of 10.1 insecure while 10.1 "owns" all of 10.1.

I guess I need something at the ESXi virtual interface or back at the router.

Derelict

Ugh.

On LAN1 reject destination LAN2 network then pass what you want below it.
On LAN1 reject destination LAN1 network then pass what you want below it.

Do not attempt to block traffic with pass rules. Explicitly block the traffic you want blocked with block/reject rules.

That said, your design is hosed.

If you want 10.0.20.0/24 and 10.1.20.0/24 to be firewalled, they need to be separate firewall interfaces. You are probably going to need a managed switch and the ability to tag multiple VLANs to vmware to accomplish what you want.

2 LANSs - need mutual exclusivity

You do not have two LANs. You have one LAN. Your hosts are out on the "WAN" as far as pfSense is concerned.