Firewall Policy & Inter-VLAN Rules
This document outlines the stateful firewall rules implemented across all network interfaces on the pfSense perimeter gateway.
1. Zero-Trust Inter-VLAN Security Model
pfSense evaluates traffic using a first-match-wins stateful policy. By default, all cross-subnet communication is blocked by an RFC1918 boundary rule unless explicitly allowed.
Universal Rule Order per Interface:
- Allow Administrative Out-of-Band Access (WireGuard / MGMT to authorized destinations).
- Allow Required Services (DNS/NTP to pfSense gateway).
- Allow Subnet-Specific Cross-Talk (e.g., LAB pushing Syslog to
10.10.30.11). - Reject RFC1918 Inter-VLAN Boundary (Blocks private subnets:
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16). - Default Allow Outbound WAN Internet (Permits outbound traffic to public Internet).
2. Interface Policy Matrix
| Interface | Allowed Destinations | Blocked Destinations | Notes |
|---|---|---|---|
| LAN (VLAN 20) | pfSense DNS (53), WAN Internet | All other RFC1918 subnets (MGMT, LAB, GST, EXEC) | Users cannot reach server hypervisors or switch management. |
| LAB (VLAN 30) | Internal LAB subnet, WAN Internet | MGMT, GST, EXEC subnets | Hypervisors and storage communicate locally inside VLAN 30. |
| MGMT (VLAN 10) | All subnets & Internet | None | Administrative control plane. |
| GST (VLAN 40) | pfSense DNS (53), WAN Internet | All RFC1918 subnets | Complete guest isolation. |
| WireGuard | MGMT (10.10.60.0/24), LAB (10.10.30.0/24) | GST (40) | Administrative tunnel for IT personnel. |