Vlans VS multiple interfaces

[while1]

Hello all
I want to separate several networks.
Restrict access between LAN TO LAN

What is better?
multiple vlans on same physical interface OR multiple physical interfaces on same vlan (0)

There is another way to limit ports in the LAN?

Thanks

[jahonix]

@while1:

separate several networks … between LAN TO LAN

You mean Lan1, Lan2, Lan3 etc - e.g. different networks?

@while1:

multiple vlans on same physical interface OR multiple physical interfaces on same vlan (0)

multiple interfaces in the same L2 segment (e.g. a bridge/switch) is highly undesirable in a software based device so a) is your best option.

@while1:

There is another way to limit ports in the LAN?

What? Say again.

[johnpoz]

Confused as well here.. You ask what is better vlans or physical, and then ask what is better vlans on the same physical interface or putting all the interfaces in the same vlan?  If you did that how you would you isolate them..

If you have the physical interfaces available and you want multiple networks so you can firewall between them.. Then sure put each interface on its own network.  Now your intervlan traffic that you do allow is not a hairpin.  When vlans share the same physical interface when vlan x talks to y you are hairpinning the traffic in and out the same interface which is a bandwidth hit..  If possible its best to isolate your networks via physical interfaces.. This is why physical interfaces are so valuable on a router..

If you want devices to be on the same vlan/network use a switch - putting a physical interface on a router (pfsense) in a bridge is normally a BAD use of the port!!

[while1]

Thanks.
I man how to block Lan1 to Lan1 on same subnet
In fact I ask how to block access within the same subnet and allow traffic only from WAN (i used nat 1:1)

Aliases AND NAT:
WAN 60.60.60.60 NAT-1:1 TO LAN 192.168.0.60
WAN 70.70.70.70 NAT-1:1 TO LAN 192.168.0.70
WAN 80.80.80.80 NAT-1:1 TO LAN 192.168.0.80
WAN 90.90.90.90 NAT-1:1 TO LAN 192.168.0.90

Firewall rules
ALLOW WAN port 80 192.168.0.60
ALLOW WAN port 80 192.168.0.70
ALLOW WAN port 80 192.168.0.80
ALLOW WAN port 22 192.168.0.90

my problem is 192.168.0.90 can access to all subnet without firewall
the role BLOCK LAN net * * * LAN net - not working for me

[jahonix]

@while1:

I man how to block Lan1 to Lan1 on same subnet

::)
You cannot do that.
That traffic is not going through your pfSense at all, the switch is the only thing involved.

[Derelict]

Layer 2 problem

Cheap d-link switch vvv


[while1]

@jahonix:

@while1:

I man how to block Lan1 to Lan1 on same subnet

::)
You cannot do that.
That traffic is not going through your pfSense at all, the switch is the only thing involved.

Thank you. Now it's clearer to me.
How do you recommend isolating each station?
I mean how to do every station will work directly to  NAT 1:1 with as little exposure as possible to LAN
(I'm working on vmware environment)

[jahonix]

As Derelict wrote, get a switch which can do private or protected ports or VLANs.