Firewall rule interface vs source network

[Krisbe]

Hi

When you add a firewall rule on a specific interface, you can select 'any' or other networks as the 'source'. What is the benefit of selecting for eg. a rule on the 'LAN' interface the 'LAN net' as the source instead of just 'any'?

Thanks

[johnpoz]

@Krisbe any would only make sense if the interface was being used as transit network.. In a normal network there would never be any source traffic into the lan interface from anything other than lan net..

Even if was being used as transit it would be better to use cidr block like say 10.0.0/22 or something if you had multiple downstream networks that fell into that /22, or even an alias with whatever your downstream networks are.

edit:
Any would make much more sense on say your WAN, not really for lan side interfaces. Where you don't know what the source would be and you want to all for say a port forward.

To expand on that - in reality your wan interface is actually a "transit" network - your connection to your isp that is a transit to get to and from the internet at large.

[viragomann]

@Krisbe
If you limit the source to the interface subnet no connected device can act as a router.
E.g. if a device has established a VPN to a remote network and is configured as a router, 'any' would allow remote resources to access anything on your site.
Apart from this you can also limit a rule to a source single IP.

[Krisbe]

@johnpoz said in Firewall rule interface vs source network:

In a normal network there would never be any source traffic into the lan interface from anything other than lan net..

Indeed. But for simple office setups, you have eg. VLANs for staff, IOT and guests. Why would you set the rules on eg. the 'staff' VLAN that has the source 'staff net' instead of just 'any', because that VLAN is just dedicated to the staff VLAN, there can be no other source.

@viragomann said in Firewall rule interface vs source network:

If you limit the source to the interface subnet no connected device can act as a router.

Good point.

[johnpoz]

@Krisbe said in Firewall rule interface vs source network:

there can be no other source.

exactly.. Rules should be as explicit as possible - why would you set any where there can only be staff, so set to staff net