Firewall blocking traffic within lan zone

[Arno]

@psherman

Did you run the connectivity test at the point I had defined? And did it work or fail?

I didn't connected the Proxmox server to the router directly.
Then I wanted to add port 1 back to br-lan and the router became inaccessible and had to get a paperclip.

So now on attempt #3.
Before I restored the internet connection I tested the Proxmox server connected to OpenWRT. Works.
Proxmox connected to unmanaged switch.
Works.

Now I have wan and lan.
What is the next step? Add dmz interface?

[psherman]

@Arno

I didn't connected the Proxmox server to the router directly.

Where/how did you connect it?

@Arno

Then I wanted to add port 1 back to br-lan and the router became inaccessible and had to get a paperclip.

Why were you changing the port assignments. my recommendation was to keep the configuration as close to the defaults as reasonably possible for this test.

@Arno

So now on attempt #3.
Before I restored the internet connection I tested the Proxmox server connected to OpenWRT. Works.
Proxmox connected to unmanaged switch.
Works.

Now I have wan and lan.

So please confirm...

• right now, you can connect from a laptop on wifi > proxmox sever as expected, right?

@Arno

What is the next step? Add dmz interface?

Yes, this is fine. Add the DMZ interface and then test the laptop (on the lan, not the dmz) > proxmox again.

[Arno]

@psherman

proxmox again.

• removed port 2 from br-lan
• created interface dmz and firewall zone dmz

ping/ssh proxmox works.
Next step: Remove all Zone forwards in the firewall?

[psherman]

@Arno

Next step: Remove all Zone forwards in the firewall?

The only one that should exist (in the default config) that you would remove for your goals is the lan > wan forward. Removing that will cause the lan to lose all upstream/internet access.

Go ahead and remove that, then test again.

[Arno]

@psherman

Removing that will cause the lan to lose all upstream/internet access.

That's not one of my goals. The goals for the firewall are:

• lan -> wan Yes
• wan -> lan Established/Related only
• lan -> dmz Yes
• dmz -> lan NO
• dmz -> wan Yes
• wan -> dmz Yes

I would like to achieve this by allowing this and not by blocking traffic I don't want.

[psherman]

@Arno

• lan -> wan Yes

If you want unrestricted lan > wan, leave the forward as it is. This is contrary to your earlier goal:

@Arno

@psherman

Everything blocked from where? Define everything

What I mean is the "first" rule of the firewall is to block anything, both local and from internet.
And then configure which traffic is allowed.
In my opinion a better approach than starting with an open firewall and block traffic you don't want.

@Arno

• wan -> lan Established/Related only

No changes necessary. This is the normal behavior.

@Arno

• lan -> dmz Yes

Add a forward for this (again, if unrestricted).

@Arno

• dmz -> lan NO

By default, this will be the case as long as the dmz network is in a separate firewall zone. Therefore, no action required.

@Arno

• dmz -> wan Yes

Add a forward from dmz > wan (again, assuming unrestricted)

@Arno

• wan -> dmz Yes

Assuming unrestricted, add a forward from wan > dmz.
For this to work from a functional standpoint, there are two other things needed:

• remove masquerading on the wan zone
• add a static route on the upstream router for the dmz network.

@Arno

I would like to achieve this by allowing this and not by blocking traffic I don't want.

Assuming that the list of traffic you want to block is smaller than the traffic you want to allow, this is fine.

[Arno]

@psherman

Add a forward for this (again, if unrestricted).

Done.

@psherman

Add a forward from dmz > wan (again, assuming unrestricted)

Done.

@psherman

Assuming unrestricted, add a forward from wan > dmz.
For this to work from a functional standpoint, there are two other things needed:

All done. Upstream router already done when installed, so no changes there.
Tested dmz -> lan: Fails (which is good).

Can I, as a last step, remove/disable IPv6?

[psherman]

Yes, if you want to disable IPv6, go ahead and remove the wan6 interface and the IPv6 related items in the lan DHCP server config. Leave everything else alone.

[Arno]

@psherman

Yes, ... alone.

Thanks for your help configuring my router.