Guest WiFi Firewall Rules with Access to Local Printer
-
This is my first attempt at setting firewall rules. Do these rules look correct for my guest wireless interface? Am I missing anything?
I want to allow the guest devices access to the Internet and my printer on my main LAN. I have used an Alias for my printer.
 -
Your allowing ALL access to the printer, every port and protocol.. If that is what you want then that is fine.
Your rf1918 rules could be combined to 1 rule you do n't really need the block to rfc1918 since your allow too ! rfc1918 takes care of that and then the default implicit deny at the end blocks any other access so that rule is kind of pointless.
-
Thanks for the feedback. I will remove the redundant RFC1918 block rule.
As for the printer, I will have to look into what are all the TCP and UDP ports that a HP Laserjet uses.
-
Since the last rule implicitly blocks all RFC1918 addresses, does this means the devices within the guest subnet are not allowed to each other? I was planning to add a NAS within the WLANGuest for guests to store files.
-
pfsense has nothing to do with traffic between devices on the same network.. Pfsense is only used to get to some other network, be it another local network or internet, etc..
Common printer port is tcp 9100.. But if your using stuff like scanning or monitoring of the printer, etc. then those would use other ports.. Quick way to see would be to log all traffic to the printer and see what ports are being used.. Then just lock it down to those ports, etc. Then again its a printer ;) It only listens on ports you prob want to use anyway, so allowing traffic to so some port that its not even listening on is not an issue..
Where you might want to limit the ports is say you don't want wifi to be able to hit the web admin page or something of the printer, and only print to the thing..