1

Given

  1. ESXi host with 1 NIC
  2. Inside the host, there're 2 virtual switches: switch1 and switch2
  3. In switch1, there's 1 WAN interface
  4. In swtich2, there's 4 VLANs: VLAN10, VLAN20, VLAN30, and VLAN40

Existing Situation:

  1. pfsense is used between switch1 and switch2 for routing
  2. VM in each VLANs can access the Internet

Purpose:

  1. prevent VM in VLAN40 access VM of other VLANs
  2. allow VM access each other within VLAN40
  3. allow VM in VLAN40 access the Internet

What I have done to achieve the Purpose:

  1. I have created 3 firewall rules in VLAN40, which is illustrated as below imageenter image description here

  2. I have created an aliases, RFC1918, which includes:

    • 10.0.0.0/8
    • 172.16.0.0/12
    • 192.168.0.0/16

Question:

  1. Are the firewall rules set correctly to achieve the purpose?
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 13 '17 at 17:51
3

Purpose:

  1. prevent VM in VLAN40 access VM of other VLANs

Is done by rule 2, unless any of your VMs in the other VLANs gets a public IP address. If you are sure that won't happen, you're fine.

  1. allow VM access each other within VLAN40

Access within the VLAN is switched and shouldn't even arrive at the firewall.

  1. allow VM in VLAN40 access the Internet

pfsense will be the local DNS server, I assume from your first rule.

In short: Yes, should work, unless some pfsense- or ESXi-specific thing happens that I didn't think of. ;)

1
  • I found there're 3 ways to setup the DNS in pfsense. Any difference between them? (1) System > General Setup > DNS servers (2) Services > DNS Forwarder (3) Services > DNS Resolver Feb 22 '16 at 1:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.