pfSense firewall rule to block WAN (Internet) access

nickelnoff · Oct 3, 2018, 4:25 PM

Hi PfSense Folk - pretty new here.

I have Windows Servers machines in a VLAN called VLAN2100_WINSRV and I need to have them to access neighboring VLANS but not get out to the internet.

I have tried this (and lots of others options) but nothing is working. enter image description here I simply need to block internet access and allow all other access.

From how I understand this rule to work all access except WAN network should be Allowed.

Help appreciated !

viragomann · Oct 3, 2018, 4:57 PM

WAN net is only the subnet configured on WAN interface.
Presumably, you have only RFC 1918 networks inside you network, it's the best way to add an alias (Firewall > Alias > IPs) and add all RFC 1918 networks to it. Then use this alias as destination in a pass rule on the appropriate interface to allow only access to internal networks.

nickelnoff · Oct 3, 2018, 5:14 PM

@viragomann said in pfSense firewall rule to block WAN (Internet) access:

tinat

Thanks

MikeV7896 · Oct 3, 2018, 5:21 PM

Actually, WAN net would be just the subnet from your ISP, and only that subnet. So anything not in that subnet - namely, the rest of the internet - would still work.

You would want to create an allow rule for each of your other VLAN networks, then a more global rule to block any, and put that block rule after your other allow rules.

stephenw10 · Oct 3, 2018, 5:24 PM

The default block rule should take care of that. Just allow only the traffic you want everything else will be blocked.

Yes, it's better to use the narrowest allow rules you can to void ever accidentally allowing access to something you didn't want to.

Steve