#FIREWALL BUILDER CLASSIFY EXAMPLE HOW TO#
#FIREWALL BUILDER CLASSIFY EXAMPLE INSTALL#

If you use this rule, I would recommend restricting as much network traffic as possible above this rule to minimize unwanted traffic. Option Value Action Pass Interface LAN Protocol any Source any Source Port any Destination any Destination Port any Description Allow access to any network/device

#FIREWALL BUILDER CLASSIFY EXAMPLE INSTALL#

This is the default “allow all” rule created by OPNsense on the LAN interface when you install OPNsense. This rule allows every device on VLAN 10 to access any open service that is running on a device with the IP address of 192.168.20.10 that resides on VLAN 20: Option Value Action Pass Interface VLAN10 Protocol any Source VLAN10 Source Port any Destination 192.168.20.10 Destination Port any Description Allow VLAN 10 access to device Allow any device to access any network or device (local networks and Internet)

This rule allows a device with the IP address of 192.168.10.10 on VLAN 10 to access any open service that is running on a device with the IP address of 192.168.20.10 that resides on VLAN 20: Option Value Action Pass Interface VLAN10 Protocol any Source 192.168.10.10 Source Port any Destination 192.168.20.10 Destination Port any Description Allow device to device access Allow any device on VLAN 10 to access any port of single device on VLAN 20 Many of these examples assume you have multiple local networks and you want to allow communication between devices in the different networks.īelow are some scenarios for creating firewall rules for your LAN/VLAN interface(s): Allow a single device on VLAN 10 to access any port of single device on VLAN 20 When you create a new VLAN or a network on another physical interface, access to all other networks are blocked by default since there are no firewall rules defined for the new network (besides hidden auto-generated ones required for DHCP to function, for instance). LAN/VLAN Rulesīy default, the LAN network in OPNsense has anti-lockout rules (to prevent you from locking yourself out of the web interface) and an “allow any” rule which allows access to all local and remote networks. You will see a list of interfaces in which you may add firewall rules. To add new firewall rules for your various network interfaces, go to the “Firewall > Rules” page. It also helps make the rules more readable since you do not have to remember that 192.168.10.10 is your laptop, PC, Raspberry Pi, etc. Aliases allow for multiple values and you can quickly change the values for several rules at the same time. If you plan to create several rules for a particular device or want to combine multiple IP/network addresses into a single rule, you may want to use aliases. It is worth noting that any IP addresses used in the examples could be substituted with aliases. I thought it would be a good idea to consolidate a variety of scenarios into a single how-to that could be used as a quick reference guide. This is especially true once you become more experienced and comfortable with writing rules.

#FIREWALL BUILDER CLASSIFY EXAMPLE HOW TO#

When looking up information on how to write firewall rules in OPNsense, you may be looking for specific examples on how to block or allow certain types of network traffic rather than how to write firewall rules in general.

Firewall builder classify example