Block an alias from accessing the internet - is this configuration correct?

[netboy]

I have this subnet called IOTP4 and the alias Deny_internetAccess points to a group of IP's in my 172.xxx.xxx.xxx subet i want BLOCKED from internet access. The WAN_subnet is an alias point to my "static" address give to me by my internet provider xxx.xxx.xxx.xxx/26 - Does this configuration essentially BLOCK internet access to my Deny_internetAccess IP's?

[netblues]

@netboy No, it doesn't It just blocks access to your localy connected public ip network.
Change destination to * for what you are asking.

[netboy]

@netblues Thank you - if i change the Destination as "Any" will this BLOCK Deny_internetAccess alias from accessing internet? will this have any issues of the IP's in Deny_internetAccess from talking to each other (any unintended consquence?)

[netblues]

@netboy A firewall can only control passing traffic through it.
What happens on the same broadcast domain is irrelevant. (unless we are talking about bridged l2 segments which I suspect isn't your case)

[SteveITS]

@netboy Netgate has examples but they are in the product manuals:
https://docs.netgate.com/pfsense/en/latest/solutions/netgate-4200/opt-lan.html#isolated

[netboy]

@SteveITS I have since changed WAN_subnet destination to "Any" like so

Kindly confirm this will BLOCK the alias Deny_internetAccess to internet?

(ignore the "Description" i can chnage it later)

[SteveITS]

@netboy yes but you haven’t allowed DNS to pfSense or elsewhere. Check the example above

[Gertjan]

@netboy said in Block an alias from accessing the internet - is this configuration correct?:

confirm this will BLOCK the alias Deny_internetAccess to internet?

Have a look for yourself (we can't ^^).
Your initial post shows

You see the "States 0/0 B" ? That means there was no traffic that matches the rule.
Compare with the last version :

Now, there is 2,68 Mbytes of traffic blocked.
You are also logging the blocked traffic, so, why not have a look at the firewall log ? There you can see the traffic that was blocked by this rule (that log is the one that confirms what happened), and the most important part ; all the source IPs that will match the "Deny_InternetAccess" alias range, your 72.xxx.xxx.xxx subnet.

[netboy]

@Gertjan Thank you. I never realized the "states" column does show the rejected info. The logs does show this worked.

[Gertjan]

@netboy
Not 'reject'.
It shows how may packets (and bytes) matched the rules, how many states are 'right now' present.

What the rule does when a packet matched, is shown like this :

or

or

"Block", "reject" or "pass".

As you can see, every pixel in the GUI contains useful information ^^

[stephenw10]

The important thing to realise here is that 'WAN subnets' is not the internet. It's only the locally connected subnets on the WAN interface. Which is why it wasn't matching any traffic initially.

[netboy]

@stephenw10 Yes i did learn that :-) Thx