Restricting LAN machine to Internet only access
-
Is there a simple way to block a specific IP from connecting to other machines on the same LAN? I'd like for it to only have internet access.
This was simple on my R7000 using a guest network, but now that it is in AP mode, it lost the ability to block connections to other computers.
I only have 1 WAN and 1 LAN connection on my pfsense machine. So what is the easiest, if even possible, way to limit an IP to WAN only?
Another question or idea. Is there a way to limit DHCP to WAN only? I've kept 192.168.50 - 100 as my DHCP, and I'm using 1-50 as my "reserved/static" IP addresses. So maybe I can stop any newly connected machine to WAN only?
-
There is no way to limit lan traffic on your gateway device. Pfsense has no control over devices talking to each other. Do you have a switch that can do vlans? What switch, is the client wired or wireless? If you have a AP that can do vlans you can create a "guest" ssid/vlan that would be limited to only internet since it would be on a different network that your normal lan.
In a wired network you would create a private vlan. In wireless you could turn on client isolation that keeps clients from talking to each other. But unless the devices are using pfsense as their gateway/router of the network they are on, you can not control what other devices they talk to since the traffic doesn't go through pfsense to talk to stuff on the same network.
-
the switch is a managed Dell PowerConnect 2724. So yes, I could do VLans through it, I've just never worked with them before.
Unfortunately the Netgear Nighthawk R7000 kills the guest network isolation when its turned into an AP. You can have a guest account, but it no longer controls the ability, or inability to block lan communication.
That said, I can live with that for now and worry about the wired part. I'd like to keep the kids PCs off the lan with my server and htpcs in the house. So I guess I need to VLan their computers to allow only Wan traffic. That's best to do with the switch itself or use pfsense?
Thanks for all the help!
-
The switch can't do it alone. You have to do VLANs on the LAN Interface of your pfsense AND on your switch. ;)
-
So create couple vlans.. Use one that can talk to each other devices on that vlan and internet. Then on your other vlan on your switch make it a private vlan so they can not talk to each other, and make sure you wifi clients are isolated from each other as well.
Then create firewall rule on this isolated segment not to be able to talk to your lan
Do you care if these clients on the internet only network talk to each other? Sounds more like you just don't want those devices talking to device on your lan network. And don't really care if they talk amongst themselves.
