OPNsense Hub: Configuration for Blocking Communication Between Two LANs
In this article, we will discuss how to configure OPNsense, an open-source firewall and router, to block communication between two LANs serving different tenants. By following the steps outlined below, you can ensure that traffic is properly isolated between the two networks, enhancing security and privacy for all users.
Prerequisites
Before we begin, make sure you have the following:
- An OPNsense hub with at least two LAN interfaces
- Two separate LANs, each with its own subnet and DHCP server
- A basic understanding of OPNsense and network configuration
Step 1: Create Aliases
To simplify the configuration process, we will create aliases for the two LANs. This will allow us to easily reference the networks in our firewall rules.
interfaces = "lan1 lan2"
for iface in interfaces:
alias = f"{iface}_net"
alias_name = f"Network for {iface}"
alias_description = f"Alias for the {alias_name}"
alias_type = "network"
alias_value = f"{iface}/{ifconfig {iface} netmask 255.255.255.0 | awk '{print $2}'}"
alias_id = alias_create(alias, alias_name, alias_description, alias_type, alias_value)
print(f"Alias {alias} created with ID {alias_id}")
Step 2: Create Firewall Rules
Now that we have our aliases set up, we can create firewall rules to block communication between the two LANs. We will create a rule for each LAN, denying traffic from the other LAN.
rules = [
{
"interface": "lan1",
"direction": "out",
"protocol": "any",
"source": {"type": "alias", "value": "lan2_net"},
"destination": {"type": "alias", "value": "any"},
"action": "block",
"description": "Block traffic from LAN2 on LAN1"
},
{
"interface": "lan2",
"direction": "out",
"protocol": "any",
"source": {"type": "alias", "value": "lan1_net"},
"destination": {"type": "alias", "value": "any"},
"action": "block",
"description": "Block traffic from LAN1 on LAN2"
}
]
for rule in rules:
rule_id = firewall_rule_create(rule)
print(f"Rule {rule_id} created")
Step 3: Test the Configuration
To ensure that the configuration is working as expected, test communication between the two LANs. You should not be able to ping or access resources on the other LAN. If communication is still possible, double-check your firewall rules and aliases.
By following the steps above, you have successfully configured OPNsense to block communication between two LANs. This is a crucial step in securing a multi-tenant network, ensuring that each tenant's data and resources are isolated and protected.