Allow OPT to connect only to WAN, not LAN
-
Bear with me, I'm a novice at this.
I have been using my SG-1100 for a while now, works great. I now need to set up an isolated network connection for a work computer. I do not want any way for data to cross between devices on the LAN port and the (for work) OPT port.
I created the interface for OPT, and of course it reports that everything is blocked.
If I simply duplicate the out of the box Firewall rules already set on the LAN port (I only use the default rules, haven't had any need to adjust them) on the OPT port, will that do the trick? Or do I need to put a rule in the OPT port to block anything to the LAN port (and vice versa)?
Thanks!
-
i would achive that with this method :
first rule: put a block to the OPT interface with destination LAN
everything else go under this rulefirst rule: put a block to the LAN interface with destination OPT
everything else go under this rule -
You don't need the lan interface rule unless you don't want lan to be able to get to opt network..
-
@NGUSER6947 said in Allow OPT to connect only to WAN, not LAN:
I do not want any way for data to cross between devices on the LAN port and the (for work) OPT port.
@johnpoz to me he asked for it
-
Yeah true does sound like that.. Just odd.. while I can understand isolating traffic from isolated network ie "not trusted" into your trusted. Don't get why you would want/need to block from trust into untrusted... But sure yeah you can for sure do it..
-
Ok, thanks to lots of help I got the OPT interface to work and can connect through it.
Can someone please check my firewall rules to see if I have these right. Again, I don't want anything from the LAN to get to OPT, and vice-versa. Thanks!
-
No they are not... When could opt net ever be a source into lan?
Your not blocking anything on opt, it can go anywhere it wants.
Rules are evaluated as traffic enters an interface from the network its attached too.
Top down first rule to trigger wins
No other rules are evaluated.When and how could the source IP of traffic come into your lan from the opt? How??
-
yup, the last rule on the LAN tab is wrong, remove it. you just need to copy the first block rule you have on LAN to the OPT interface but with destination 'LAN net'
-
Ok so like this:
Thanks again. This is not my specialty so I appreciate all the help I get here.
-
Keep in mind if opt has IPv6 addresses that lan would be able to talk to those..
-
If my IPv6 configuration type is set to None that would preclude that, correct?
-
on your opt, then sure..
