Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a stateful firewall (pfsense) with a WAN and LAN port, with the LAN port connected to an unmanaged switch (DLink Gbit) and several computers connected to the switch.

I was wondering if the switch obeyed firewall rules, i.e. if I blocked all traffic between two computers with a rule on the firewall, would the switch still pass traffic because it is all local and doesn't go through the firewall?

share|improve this question
PFSense is certainly a SF trchnology, and the belongs-on-* tag is depreciated ( – Mark Henderson Jan 10 '10 at 22:17
Not sure who is voting to send to SU, but firewall and switching questions definitely belong here. – Sam Jan 11 '10 at 13:42
up vote 6 down vote accepted

The switch doesn't know anything about the rules on your firewall and the firewall can only act on traffic that flows through it. So for your local traffic through the switch, it shouldn't be affected by the firewall rules at all.

share|improve this answer

joeqwerty is correct an unmanaged switch knows nothing. It works a lower layer in the network stack which knows nothing about the firewall rules or even the ip address, port, data payload, etc of a packet. It just sends packets to their destination or next hop based on the MAC address and ARP tables.

What you need is a managed switch that supports ACLs. VLANs may also be an option depending on your goals.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.