• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

[SOLVED] VLAN isolation issue

Scheduled Pinned Locked Moved Firewalling
4 Posts 3 Posters 607 Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • G
    graymattr
    last edited by Dec 17, 2017, 4:08 AM Dec 17, 2017, 3:34 AM

    I want to start by apologizing because I think I'm missing something painfully obvious.  Ok, with that out of the way, here we go.

    I have a newly created Untrusted VLAN (302) which I would like to only allow access to the internet ie, no other (V)LANs, or intra-VLAN 302 traffic.  I have accomplished everything but the last one, as I am still able to ping/navigate to other hosts on VLAN 302 when I am on that VLAN (other LANs are correctly blocked).

    I am also running an always on OVPN client, in case that somehow comes into play.

    Since a picture is worth a thousand words, I have attached my VLAN 302 rules.

    Thanks in advance for any suggestions!

    ![Screen Shot 2017-12-16 at 7.30.51 PM.png](/public/imported_attachments/1/Screen Shot 2017-12-16 at 7.30.51 PM.png)
    ![Screen Shot 2017-12-16 at 7.30.51 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2017-12-16 at 7.30.51 PM.png_thumb)
    ![Screen Shot 2017-12-16 at 7.26.49 PM.png](/public/imported_attachments/1/Screen Shot 2017-12-16 at 7.26.49 PM.png)
    ![Screen Shot 2017-12-16 at 7.26.49 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2017-12-16 at 7.26.49 PM.png_thumb)

    1 Reply Last reply Reply Quote 0
    • G
      Grimson Banned
      last edited by Dec 17, 2017, 3:59 AM

      https://doc.pfsense.org/index.php/Firewall_Rule_Troubleshooting#Unfilterable_Traffic

      1 Reply Last reply Reply Quote 0
      • D
        Derelict LAYER 8 Netgate
        last edited by Dec 17, 2017, 4:07 AM

        You have to filter same-interface/same-subnet traffic at layer 2 (APs, Switches).

        That traffic is not even sent to the firewall. They ARP for each other and communicate directly.

        If you unplugged pfSense they could still communicate.

        ![Screen Shot 2017-12-16 at 8.06.21 PM.png](/public/imported_attachments/1/Screen Shot 2017-12-16 at 8.06.21 PM.png)
        ![Screen Shot 2017-12-16 at 8.06.21 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2017-12-16 at 8.06.21 PM.png_thumb)

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • G
          graymattr
          last edited by Dec 17, 2017, 4:08 AM

          Welp, that would be the super simple thing that I was missing.  :)  Thanks for the pointer, folks!

          1 Reply Last reply Reply Quote 0
          4 out of 4
          • First post
            4/4
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
            This community forum collects and processes your personal information.
            consent.not_received