I’m still trying to learn my way around vyos and I’ve been enjoying the process. I’m still trying to wrap my brain around how to read the firewall rulesets so I can actually manipulate them in a predictable manner that actually gives me confidence it’s doing what I think it should do. I’m slowly piecing together all the things opnsense used to do for me automagically. I am currently stumped on what obvious thing I’m missing to isolate my LAN-UNTRUSTED from my LAN-TRUSTED. Essentially I’m treating LAN-UNTRUSTED like an IoT network where I want LAN-TRUSTED to uni-directionally be able to access LAN-UNTRUSTED, but not the reverse, while letting both still access the internet. I’m 99% it’s the forward chain I need to be manipulating and I tried to mirror the example OUTSIDE-IN rules.
As it’s currently written an IP in LAN-UNTRUSTED (17.16.95.50) can access an IP in LAN-TRUSTED (192.168.95.50) so obviously I’ve missed the mark somewhere.
eth4 is WAN. eth5* are all LAN.
An extra pair of eyes would be greatly appreciated to let me know what I’m doing wrong here. Thanks!
group {
interface-group LAN {
interface "eth5*"
}
interface-group WAN {
interface eth4
}
network-group LAN-TRUSTED {
network 192.168.5.0/24
network 192.168.10.0/24
network 192.168.65.0/24
network 192.168.95.0/24
}
network-group LAN-UNTRUSTED {
network 172.16.5.0/24
network 172.16.95.0/24
}
network-group NET-INSIDE-v4 {
include LAN-TRUSTED
include LAN-UNTRUSTED
}
port-group HAPROXY_PORTS {
port 80
port 443
}
}
ipv4 {
forward {
filter {
rule 10 {
action jump
jump-target CONN_FILTER
}
rule 100 {
action jump
destination {
group {
network-group NET-INSIDE-v4
}
}
inbound-interface {
interface-group WAN
}
jump-target OUTSIDE-IN-v4
}
rule 110 {
action jump
destination {
group {
network-group NET-INSIDE-v4
}
}
inbound-interface {
interface-group LAN
}
jump-target LAN-IN
}
}
}
input {
filter {
default-action drop
rule 10 {
action jump
jump-target CONN_FILTER
}
rule 20 {
action jump
destination {
port 22
}
jump-target MGMT
protocol tcp
}
rule 30 {
action accept
icmp {
type-name echo-request
}
protocol icmp
state {
new enable
}
}
rule 40 {
action accept
destination {
port 53
}
protocol tcp_udp
source {
group {
network-group LAN-TRUSTED
}
}
}
rule 50 {
action accept
source {
address 127.0.0.0/8
}
}
}
}
name CONN_FILTER {
default-action accept
rule 10 {
action accept
state {
established enable
related enable
}
}
rule 20 {
action drop
state {
invalid enable
}
}
}
name LAN-IN {
default-action drop
rule 100 {
action accept
destination {
group {
network-group LAN-UNTRUSTED
}
}
source {
group {
network-group LAN-TRUSTED
}
}
state {
new enable
}
}
}
name MGMT {
default-action return
rule 15 {
action accept
inbound-interface {
interface-group LAN
}
source {
group {
network-group LAN-TRUSTED
}
}
}
rule 20 {
action drop
inbound-interface {
interface-group WAN
}
recent {
count 4
time minute
}
state {
new enable
}
}
}
name OUTSIDE-IN-v4 {
default-action drop
}
}
ethernet eth0 {
hw-id 0c:c4:7a:d9:e5:18
}
ethernet eth1 {
hw-id 0c:c4:7a:d9:e5:19
}
ethernet eth2 {
hw-id 0c:c4:7a:d9:e5:1a
}
ethernet eth3 {
hw-id 0c:c4:7a:d9:e5:1b
}
ethernet eth4 {
address dhcp
hw-id e4:1d:2d:49:d1:00
}
ethernet eth5 {
address 192.168.5.5/24
hw-id e4:1d:2d:49:d1:01
vif 95 {
address 192.168.95.5/24
}
vif 96 {
address 172.16.95.5/24
}
}
loopback lo {
}