How to block all internal connections?

IHateWindows · Aug 2, 2017, 9:36 PM

I would like to block all internal connections in my pfSense network so I can block all connections from device to device, the purpose is that only permitted devices can access other devices in the network, but I can not make it work. Can you help me out?

This is my current setup:

Derelict · Aug 2, 2017, 9:39 PM

You cannot block communication between two layer 2 devices with a layer 3 device like pfSense. You need to do it at layer 2. A router is not involved in the communication between two same-subnet hosts.

This is a cheapie D-Link switch.

You would mark all the client ports as protected. They would only be able to exchange traffic with unprotected ports, not with each other. You would put the router on port 1 and the isolated clients on 2-8.

Wireless devices usually have something named similarly to wireless client isolation.

![Screen Shot 2017-08-02 at 2.37.33 PM.png](/public/imported_attachments/1/Screen Shot 2017-08-02 at 2.37.33 PM.png)
![Screen Shot 2017-08-02 at 2.37.33 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2017-08-02 at 2.37.33 PM.png_thumb)

jahonix · Aug 2, 2017, 10:53 PM

@Derelict:

You cannot block communication between two layer 2 devices

…especially not on the WAN interface.

Derelict · Aug 2, 2017, 11:08 PM

lol I didn't even look at that rule.