Interface connects to Router: Best-Practices on how to allow access to router's subnets?

[ivo.a.v.tavares]

I'm learning this by myself (networking), using GNS3 emulation. So, please bear with my lack of knowledge.

A static IP interface from the pfSense firewall connects to a Router.
This interface is neither the LAN nor the WAN default interfaces. Let's call it DMZ (I still need to read on this DMZ notion).

What are the best-practices for setting the infrastructure (firewall rules and routes) between any LAN end device and any DMZ end device?

• I've already added a static route between the firewall and 192.168.4.0/24 network.
• I have the following 'From LAN To *' rules:
  
  Right now:
• I can ping from the firewall to USrv-1
• Because of the ruleset, the firewall does not allow pinging along any route through the firewall.
• From UbuPC-1, I can telnet to R2 on port 80, or do a curl.
• From UbuPC-1, I cannot telnet or curl to the 192.168.4.0/24 subnet.
  It think's it due to my custom default reject all from LAN rule, since DMZ subnets only encompasses 10.10.10.20.0/24 subnet.
  Should I explicitely create a rule to allow LAN to connect to 192.168.4.0/24 subnet as a best-practice?

[SteveITS]

@ivo.a.v.tavares yes because the 192.168.4.0/24 is not in DMZ SUBNETS.

Also any software firewall in the target needs to allow connections from the other subnet.