Prohibit communication between VLANs



  • Hi guys, I'm setting up five VLANs piggybacking on a single physical LAN interface.

    I am trying to stop the VLANs from talking to each other as well as being able to reach the LAN (management) network. For example:

    6dc89329-020e-4653-af13-de7664306e71-image.png

    Now sadly at this point I haven't got any devices available to connect to one of these networks so I am only using the ping function of pfSense Diagnostics. And although the rules appear to be fine, I can still ping the LAN address 172.16.40.1 from a VLAN source address.

    702bebc3-0111-4d87-b63c-4dc2eb962df7-image.png

    What am I doing wrong?

    BTW. I followed this guide to sert up the VLANs and rules:
    Youtube Video



  • No user rule can block traffic from pfSense itself. That is to say, you cannot test your rules with the ping function of pfSense.

    Instead of adding a filter rule for each unique of your networks you can add all network to a single alias and use this at destination in a single block rule.
    Best practice is to add an alias and add all RFC 1918 networks to it and use this one. So you're save as well, if you add a VLAN or change a network.



  • @viragomann said in Prohibit communication between VLANs:

    No user rule can block traffic from pfSense itself. That is to say, you cannot test your rules with the ping function of pfSense.

    Ha! So I am not going mad then!

    @viragomann said in Prohibit communication between VLANs:

    Instead of adding a filter rule for each unique of your networks you can add all network to a single alias and use this at destination in a single block rule.
    Best practice is to add an alias and add all RFC 1918 networks to it and use this one. So you're save as well, if you add a VLAN or change a network.

    Yes, that would have saved me a lot of work lol. I have been setting the rulesets manually for each VLAN!



  • Another way to save time when roll out similar rules on multiple interfaces is to use the copy function:
    522e8083-451d-4978-912f-dd6ad4d3c31d-grafik.png

    Just hit the button, a copy of the rule will be opened. Then change the interface. Together with the RFC1918 alias that's all you have to do to add the rules to another interface.



  • @viragomann Excellent! Thanks!


  • LAYER 8 Global Moderator

    Yet another way to save time would be to put your networks in an alias and use that in a single rule vs multiple rules.

    I have an alias with all of rfc1918 space in it, so if I want to block a specific vlan from talking to other vlans I just use that as the destination..

    There are multiple ways to skin a cat ;)


Log in to reply