DROP most LAN to LAN
-
gotcha.
not that it makes a diff, but all guests are ubuntu (with the debian host).
i could use ufw on the guests, but I really didn't wanna mess with any guest firewalling rules... iptables ALLOWs everything and UFW is not even installed.
-
You could always do this with vlans but then you need a layer 3 switch.. Create a "LAN" for each machine. Then you could do all kinds of subnet magic..
-
@chpalmer Don't think a layer 3 switch is possible with a single physical machine and two NICs, but only one uplink (the other is disconnected)
proxmox does have VLANs though, but I think it would complicate things if the VLANs are not setup in pfsense... might have to go the client firewall way
-
You don't need a L3 switch to do vlans... All you need is L2 smart switch..
But if you don't want clients talking to each other - then you could do something with private vlans.. This would be done on your switch.. Not pfsense.
How many clients do you have?
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 24.11 | Lab VMs 2.7.2, 24.11 -
@johnpoz said in DROP most LAN to LAN:
You don't need a L3 switch to do vlans... All you need is L2 smart switch..
But if you don't want clients talking to each other - then you could do something with private vlans.. This would be done on your switch.. Not pfsense.
Thanks! That is good to know. I don't do VLANs at all so Im not real up to standard there. But he did mention that there were a few exceptions with machines communicating with each other..
with a couple of obvious and one custom exception.
Im thinking a firewall rule or two for these.
-
Well if he wants some exceptions then sure vlans would be the way to do it sure.
-
there are less than 15 LAN clients, between containers and VMs...
-
Still if what your wanting to do is segment your different clients so client X and Y can not talk to A and B, then yeah you put x and y in vlan 10, and a and b in in vlan 20, and then firewall between them with pfsense.
I sure and the F not create 15 different vlans ;)
-
@pitchfork said in DROP most LAN to LAN:
don't want my LAN machines open to each other, with a couple of obvious and one custom exception.
There are some switches that can isolate ports so they can only talk to an uplink port. My TP-Link TL-SG105E (Johnpoz's favourite) will do that. TP-Link calls it a Multi-Tenant Unit VLAN.
-
These are VMs/Containers. Any isolation would have to be done in the vswitch. Or perhaps in the proxmox firewall.
