[SOLVED] why my WIFI-GUEST communicates with my LAN
-
Hello,
My configuration :
LAN - 192.168.1.0
WIFI-GUEST 192.168.3.0My firewall configuration for the WIFI-GUEST
I'm able to ping from my WIFI-GUEST network to my LAN network because the destination is ANY for ICMP
I should add the first rule below to block all communication between my WIFI-GUEST and my LAN
But i would like to delete this rule and configure properly my destination, any idea ?
Regards,
Kevin
-
so where do you want your guest to go on 53 (dns) What is the dest you want them to go? The whole internet? What exactly uses 443 and 80 on UDP?
If you want them to ping your lan, then put that rule above your block rule. But your rules will work just fine. Normally you would have source net on their of your wifi net. And https is not done over udp, so allowing 443 on udp makes zero sense, etc.
Why exactly are you wanting to limit your guests to only dns, http/https? As long as they don't talk to your network why should you care where guests go and what ports/protocols they use?
So for example this is my guest wifi rules.
I allow them to ping the pfsense interface on that network. Just so they can validate they can get to their gateway. IPv6 really needs icmp to function correctly. There might even be some hidden rules pfsense does for icmpv6 when enable ipv6 on it. But that is there for my sanity that icmpv6 is open.
I then reject any other traffic at all to ANY IP address on pfsense. be it other networks or wan IP, etc. I use reject on purpose because I have clients sometimes on that network and want to see the reject. But you could just block if you wanted.
I then have rules that say as long as your not going to my ipv4 or ipv6 networks - you can do whatever you want. Keep in mind my guest via dhcp do not get handed pfsense for dns, they get handed public/isp dns.
-
Hello Johnpoz,
Thank you for your help.
It works !
Regards,
Kevin
-
So see you were picked up on the alias that I created for rfc1918, was going to mention that and forgot ;)
