One wan, multiple isolated lans, nat

[fourseasons]

Hello

I recently received a SG4860 and studied the various howtos on this site to get a hang of the basic configuration. My plan is to configure the firewall as best I can and use the free included support hours to have a professional look over it before it goes into "production".

I need three LAN networks:

LAN - 192.168.0.1/24
OPT1 - 192.168.5.1/24
OPT2 - 192.168.10.1/24

all of them with access to one WAN IP (using NAT)

all of them should be isolated from eachother

IPv6 is disabled.

I'm trying to do this step by step and get the basics sorted first.
is this firewall rule setup correct so far?

[Trel]

Is it your intention that someone could manually set a route and access all LAN, OPT1 and OPT2 when connected to OpenVPN?
(Other than that, I'm not seeing anything that would break the setup rule-wise)

[fourseasons]

@Trel:

Is it your intention that someone could manually set a route and access all LAN, OPT1 and OPT2 when connected to OpenVPN?
(Other than that, I'm not seeing anything that would break the setup rule-wise)

That's not necessarily the primary intention but yes, I'd like to be able to access all 3 networks via OpenVPN.

I've since "cleaned up" the rules using an RFC1918 alias but it's good to have some confirmation that I'm headed in the right direction. I've also managed to set up 3 virtual (public) ips on the WAN and give each network it's own IP using outgoing manual NAT.

Fortunately I have a lot of time to get things right before I have everything looked over by pfsense support (unless such usage of an incident is frowned upon?) and put the box "live".

The free gold subscription that was included with the hardware helps a lot.

[Derelict]

What about access from the various LANs to services running on the firewall like the webconfig?

All LANs will be able to access that.