I apologize for this n00b question, but I'm trying to learn networking to help at a non-profit where the old IT guy is no longer there. They have several Cisco switches and one pfSense instance that controls the network. I have a basic idea of how certain things work (a few VLANs, a DMZ), but there is a basic thing I don't get: how does it control all the network traffic?

I see a bunch of different sets of firewall rules, but how exactly are they applied if the pfSense box is just another networking device plugged into the switch?

Again, it's certainly very simple, but I missed something in all the Youtube videos I've been watching.


There are a couple of possibilities.

  1. Your firewall does not control internal traffic between your PCs. Only traffic between you and the Internet.
  2. If you have a few VLANs, the firewall can control traffic between them.

This is all speculation, of course. We would need a diagram of your network and device configurations to say for sure.

  • The firewall controls all network traffic between the VLANs and to the internet, I'm sure of that. My question is really about the mechanism behind this control. How does it work?
    – daveslab
    Apr 5 '19 at 19:30
  • There are lots of sources just a quick Google search away that can explain it better than we can in this small space.
    – Ron Trunk
    Apr 5 '19 at 20:08

If I understand correctly, your psSense is acting like a router between your vlans. Think of your pfSense as a device that lives in all of your vlans. If traffic hits your switch and it doesn't know the MAC address (because the destination is not within that vlan), it will send it to all the ports on that vlan, which will include your pfSense. Your pfSense will then take that traffic, examine it, figure out which vlan it does need to go to, likely evaluate if the traffic is even allowed to go to that vlan, then repackage it and send it back to the switch in the vlan it is destined for. This time when it hits the switch, it should either know which port to send it out of directly or at least, if it does have to send it out all ports within that vlan again, it will get to its destination.

Not the answer you're looking for? Browse other questions tagged or ask your own question.