Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Isolate Guest and DMZ Networks

    Firewalling
    3
    12
    917
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JKnottJ
      JKnott @Bambos
      last edited by

      @bambos

      Here are my rules for my guest WiFi, which allow access only to the Internet and pinging the interface. You'll have to add appropriate rules for incoming traffic.

      f90ff9bd-55ad-4bfd-a976-169fd08b0c2d-image.png

      PfSense running on Qotom mini PC
      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
      UniFi AC-Lite access point

      I haven't lost my mind. It's around here...somewhere...

      B 1 Reply Last reply Reply Quote 0
      • B
        Bambos @JKnott
        last edited by

        @jknott Hello and thank you for your comment. Where is the rule that blocks access to your main LAN ?

        DerelictD JKnottJ 2 Replies Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate @Bambos
          last edited by

          @bambos Screen Shot 2017-08-06 at 2.26.11 PM.png

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          B 2 Replies Last reply Reply Quote 0
          • JKnottJ
            JKnott @Bambos
            last edited by

            @bambos said in Isolate Guest and DMZ Networks:

            @jknott Hello and thank you for your comment. Where is the rule that blocks access to your main LAN ?

            The 2nd & 3rd lines cover every possible address that might appear on any of my local LANs. One blocks all private addresses and the other all addresses within my IPv6 /56 prefix. For good measure, the 4th line blocks my WAN address on both IPv4 & IPv6. This leaves only pinging the interface, as specified in the 1st line and the last line allows access to the Internet.

            Also, you'll notice I use reject rather than block. This tells the device the connection is not allowed, which is faster than waiting for a block to time out. However, I use block on the WAN rules, so that port scanning will not reveal the existence of my firewall. I'm not worried if an attacker wastes time on a block, instead of a reject.

            PfSense running on Qotom mini PC
            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
            UniFi AC-Lite access point

            I haven't lost my mind. It's around here...somewhere...

            1 Reply Last reply Reply Quote 0
            • B
              Bambos @Derelict
              last edited by

              @derelict Does the last 2 rules ovveride the block rules above ?
              how is the evaluation ?
              what happent if a rule match ? is it executed and dropping the packet, or going top to bottom ?

              JKnottJ 1 Reply Last reply Reply Quote 0
              • JKnottJ
                JKnott @Bambos
                last edited by

                @bambos

                Rules are processed in order until a match is found. So, after blocking local LAN addresses and the WAN address, the only thing left for the last line to allow is the Internet. So, a connection to my LAN would be stopped by line 2 or 3 and never reach the last line. Likewise an attempt to connect to my WAN address would be stopped by line 4 and never reach the last line. However a ping to my guest LAN interface is matched by the 1st line and allowed. In this instance no other line is involved.

                PfSense running on Qotom mini PC
                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                UniFi AC-Lite access point

                I haven't lost my mind. It's around here...somewhere...

                1 Reply Last reply Reply Quote 0
                • B
                  Bambos @Derelict
                  last edited by

                  @derelict Thank you so much, but from guest network i'm able to see the web interface of pfsense gui.

                  to my understanding , i can't block this because will loose connectivity and services because is acting also as gateway.... SO ?? does this mean i have to change the default port ? What do you think ?

                  JKnottJ DerelictD 2 Replies Last reply Reply Quote 0
                  • JKnottJ
                    JKnott @Bambos
                    last edited by

                    @bambos

                    That's not quite the way it works. When you have a packet going out to the Internet, the destination is whatever address out there, not the pfsense LAN address. Rules filter on source & destination addresses. Since a packet going to the Internet will not have that LAN address as destination, it won't be blocked. However, attempting to access pfsense will be.

                    PfSense running on Qotom mini PC
                    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                    UniFi AC-Lite access point

                    I haven't lost my mind. It's around here...somewhere...

                    B 1 Reply Last reply Reply Quote 0
                    • B
                      Bambos @JKnott
                      last edited by

                      @jknott the antilockout rule is source : ANY, destination: LAN Address.
                      if i change this to source, LAN NET, does this going to restrict GuestLAN to see the pfsense gui on LAN ?

                      JKnottJ 1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate @Bambos
                        last edited by

                        @bambos said in Isolate Guest and DMZ Networks:

                        @derelict Thank you so much, but from guest network i'm able to see the web interface of pfsense gui.

                        Not if you block access to "This Firewall" as in that example you won't.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • JKnottJ
                          JKnott @Bambos
                          last edited by

                          @bambos

                          Blocking access to the interface will not block traffic passing through it, as the interface IP address does not appear in any packet passing through the router. Only if you use the interface address as the destination will it be blocked by a rule to block such access.

                          PfSense running on Qotom mini PC
                          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                          UniFi AC-Lite access point

                          I haven't lost my mind. It's around here...somewhere...

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.