Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    1 WAN 3 LAN - Blocking LAN ports from each other.

    Firewalling
    2
    4
    3468
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      SparcV last edited by

      Here's my setup

      WAN - Cable modem
      LAN - 192.168.1.0/24
      OPT1 - 10.0.0.0/24
      OPT2 - 172.0.0.0/24

      I want to block traffic from going across the LAN ports but still be able to access the internet via the WAN port
      I have setup firewall rules to block each others subnet, but it does not seem to do anything.
      Im running 1.0 Beta 2

      1 Reply Last reply Reply Quote 0
      • H
        hoba last edited by

        Make sure the rules order is correct (first match). However, without seeing your rules we can't really help you.

        1 Reply Last reply Reply Quote 0
        • S
          SparcV last edited by

          @hoba:

          Make sure the rules order is correct (first match). However, without seeing your rules we can't really help you.

          LAN
          Proto  Source  Port  Destination  Port  Gateway  Description

          • OP1 net * * * * Block OP1
              * OP2 net * * * * Block OP2
          • LAN net * * * * Lan to Any

          OP1
          Proto  Source  Port  Destination  Port  Gateway  Description

          • LAN net * * * * Block LAN
              * OP2 net * * * * Block OP2
          • OP1 net * * * * OP1 to Any

          OP2
          Proto  Source  Port  Destination  Port  Gateway  Description

          • LAN net * * * * Block LAN
              * OP1 net * * * * Block OP1
          • OP2 net * * * * OP2 to Any

          Those are the rules i have set for each port

          1 Reply Last reply Reply Quote 0
          • H
            hoba last edited by

            Yeah, those are wrong.

            at LAN:
            block, proto any, source any, destination OPT1 subnet
            block, proto any, source any, destination OPT2 subnet
            pass, proto any, source lan subnet, destination any (default LAN to any)

            at OPT1:
            block, proto any, source any, destination LAN subnet
            block, proto any, source any, destination OPT2 subnet
            pass, proto any, source OPT1 subnet, destination any

            at OPT2:
            block, proto any, source any, destination LAN subnet
            block, proto any, source any, destination OPT1 subnet
            pass, proto any, source OPT2 subnet, destination any

            You always block incoming traffic at an interface.

            1 Reply Last reply Reply Quote 0
            • First post
              Last post