Separate Network

[doktornotor]

Looks good. You can make ports alias (like, ManagementPorts or whatever) for 22+80+443 and make the first 3 rules into a single one.

[ditrone]

@doktornotor:

Looks good. You can make ports alias (like, ManagementPorts or whatever) for 22+80+443 and make the first 3 rules into a single one.

Excellent i was wondering how to add multiple ports to a firewall rule. 
Using alliases might help with ram and swap consumption as well.
Currently swap is 
60% of 1024 MB
and ram is
65% of 467 MB

Here is how i have it now and it is working fine.


[Derelict]

If you want them to be able to ping and do dns lookups, I don't see why you wouldn't pass those then block everything else.  It's more sound firewall rule design.

[ditrone]

@Derelict:

If you want them to be able to ping and do dns lookups, I don't see why you wouldn't pass those then block everything else.  It's more sound firewall rule design.

I tried blocking all rfc1918 traffic on the interface but i can't seem to move that rule below the rules allowing dns.
captive portal stops working. well captive portal works but dns doesnt.
when you say " It's more sound firewall rule design." what do you mean?

[Derelict]

Pass what you need them to have access to and block everything else.  The way you're doing it if you start another service on the firewall, change your webgui port, etc you have to remember to specifically block it.

You need to add things like DNS servers to your captive portal allowed IP addresses in addition to passing the DNS traffic in the regular firewall.