Disable WAN Network reachability from LAN

user7364

Hello,

I am a bit new to pfSense. I have a cable modem which can not be configured to act only as a modem. So it is a router with DHCP.

My problem is, that the WAN Network is reachable from the LAN Network. I was able to disable this, but now I can not access the pfSense Webconfig from the WAN Net.

It is possible to:

Disable access from the LAN Net to all clients and gateway of the WAN Net
Enable reachability from the WAN Net to the pfSense IP (Webconfig)

?? And if so, how can I do this ?

viragomann

Just add a firewall block rule to the top of the LAN rule set with WAN net as destination:
action: block
interface: LAN
protocol: any
source: any
destination: WAN net

Nothing more to do. This rule won't have any impact on the accessibility to WAN addresses from WAN side.

user7364

@viragomann said in Disable WAN Network reachability from LAN:

Just add a firewall block rule to the top of the LAN rule set with WAN net as destination:
action: block
interface: LAN
protocol: any
source: any
destination: WAN net

Nothing more to do. This rule won't have any impact on the accessibility to WAN addresses from WAN side.

thanks for the reply. I already tried that. But with this rule i can connect from the LAN to the gateway of the WAN (which is the router). The WAN Clients are blocked, but the gateway is reachable.

When i disable the LAN > WAN Rules (auto created) under Firewall > NAT > Outbound everything seems to work. But i do not know if i need the rules for something.

viragomann

You may have still access to the internet over the gateway and to the public IP of the gateway but not to the internal address of it (WAN net) with that.
If you want to block any traffic from LAN disable the default allow any rule on LAN interface, but ensure that you keep access to the WebGUI (Anti-Lockout rule).

@user7364 said in Disable WAN Network reachability from LAN:

When i disable the LAN > WAN Rules (auto created) under Firewall > NAT > Outbound everything seems to work. But i do not know if i need the rules for something.

That's the NAT rule translating the source IP of outgoing packets to the WAN address. If you don't need internet access you may disable this.