1

I've got a lab environment here for some testing of software which should only run on this "lab environment" network.

To that end, the "lab environment" has a pfsense firewall sitting on the periphery of the network, acting as the "gateway".

I need to set pfSense to prohibit all internal LAN addresses from connecting outbound to the Internet, with the exception of a single system which has an IP addressed to it statically.

I have tried blocking FROM LAN Address -> (any) with no luck, as the system has still been able to reach out to the internet with that rule. Creating a "Pass" rule is easy enough for this, I think, FROM 172.16.1.1 TO (any).

Can someone help me out with these firewall rules? Kinda new to pfSense, as I come from an iptables-at-the-network-edge environment, so any help would be appreciated.

1 Answer 1

5

You don't block "LAN Address", you need to block "LAN Subnet".

Do the following:

  • Add a rule as the first rule: PASS, 172.16.1.1 -> ANY
  • Add a rule as the second rule: DENY, LAN subnet -> ANY
4
  • *facepalms* God I feel stupid now for not noticing the LAN subnet option in the rules. Thanks for the help, these rules are working now. Jul 4, 2014 at 17:51
  • Don't worry, happens to the best of us. have fun
    – MichelZ
    Jul 4, 2014 at 18:01
  • hate to pick your brain again, but can a similar rule be made to prevent interfaces/subnets from communicating with each other? we don't want machines on the LAN interface and machines on the OPT1 interface to communicate with each other, is it as simple as DENY LAN subnet -> OPT1 subnet and DENY OPT1 subnet -> LAN subnet? Jul 6, 2014 at 19:30
  • Yes, it's as simple as that :) Just do it on the correct interface! (Deny LAN on LAN interface, Deny OPT1 on OPT1 Interface)
    – MichelZ
    Jul 7, 2014 at 5:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .