Configure filewall rules to allow traffic initiated from Lan to OPT1 but not visaversa

[munson]

I am a newbie (no more said). My LAN is 192.168.1.x /24 and my OPT1 is 192.168.165.x/24. I want to be able to initiate traffic from LAN to OPT1 but not OPT1 to LAN. LAN is my computer network and OPT is my IOT network. I tried the following:

Rules (Drag to Change Order)
States Protocol Source Port Destination Port Gateway Queue Schedule Description Actions
2 /2.53 MiB

• • • LAN Address 443
      80 * * Anti-Lockout Rule
      35 /15.99 MiB
      IPv4 * LAN net * OPT1IOT net * * none Default allow LAN to any rule
      0 /0 B
      IPv6 * LAN net * * * * none Default allow LAN IPv6 to any rule

Edit Firewall Rule

This does not seem to work.

I can ping from the LAN to OPT1 but not from OPT1 to LAN
Any suggestions?

[netblues]

You need to post rules both from lan and opt1 interfaces to receive anything meaningfull

[whitekalu]

I don't know about the pfSense firewall rules as I'm also a newbie with pfSense.
If I were you and I felt that I have configured pfSense firewall correctly then I would check the firewall systems in client are blocking the ICMP Echo request.
Just my cheap opinion.

[munson]

Here are the rules
)

I appreciate any help and advice you can prove

[munson]

Here is the OPT1IOT interface setup.

[netblues]

As far as pfsense is concerned all traffic is allowed on both interfaces.
Additionally last two rules on lan won't match any traffic just because it already matches on the second from top.
Check firewall settings on lan machines.

[Derelict]

You do not need to do anything on LAN. It has a default pass source LAN net to dest any.

On OPT1IOT you want to:

Pass source OPT1IOT net dest any pfSense-served connections they need like DNS
Reject source OPT1IOT net dest LAN net
Reject source OPT1IOT net dest This firewall (self)
Pass source OPT1IOT net dest any

[munson]

Hi

Thanks for your quick response

@Derelict said in Configure filewall rules to allow traffic initiated from Lan to OPT1 but not visaversa:

On OPT1IOT you want to:
Pass source OPT1IOT net dest any pfSense-served connections they need like DNS

Do you mean this:

Reject source OPT1IOT net dest LAN net

Reject source OPT1IOT net dest LAN net
Do you mean this:

Reject source OPT1IOT net dest This firewall (self)
Do you mean this:

Pass source OPT1IOT net dest any
Do you mean this:

Thanks