DMZ can't get out to wan

[4evernoob]

Odd.

This does not work:
ID  Proto    Source    Port Destination Port Gateway Queue Schedule Description
      IPv4 *  DMZ net  *    WAN net    *    *          none

This does:
ID  Proto    Source    Port Destination Port Gateway Queue Schedule Description
      IPv4 *  DMZ net  *        *              *    *          none

OPT1 = DMZ
Outbound NAT set to auto.
No gateway set on DMZ
WAN = pppoe

[Derelict]

The first rule will only allow traffic to addresses on WAN net, not anything beyond (ie out on the internet).

The second rule allows traffic to *, so it's handed to the routing table and sent off to its destination via the default gateway.

[4evernoob]

So I was thinking that the * would allow access to everything as in LAN and firewall itself. Is that not the case?

[vindenesen]

@4evernoob:

So I was thinking that the * would allow access to everything as in LAN and firewall itself. Is that not the case?

• on destination gives access to everything, as in all local and remote networks. In your case, it will give access to all addresses on LAN, WAN and even management ports on your firewall (which you probably shouldn't do).

If you want the DMZ-network to get access to WAN, and only that, you can use this method:

• Create an alias containing all your local networks, call it something like "Local_networks". This alias will then include your LAN and DMZ-network. In addition, you should add your WAN IP address also.

• Create a rule on the DMZ interface, set destination to "not Local_networks"

[Derelict]

Here's how I do my guest Wi-Fi.


[4evernoob]

Oh I see, thanks guys.