F5F Stay Refreshed Power Users Networks Blocking certain LAN traffic with OPNsense OPNsense managing network traffic on local area networks

Blocking certain LAN traffic with OPNsense OPNsense managing network traffic on local area networks

Blocking certain LAN traffic with OPNsense OPNsense managing network traffic on local area networks

X
XLottinskiX
Member
54
02-24-2025, 04:40 PM
#1
Hey everyone, I'm just getting started with OPNsense and hit a snag. The ping to 10.0.77.20 is fine, but accessing the web interface at 10.0.77.20:8006 gets blocked by the firewall. When I try 'mylaptop' → proxmox, it works, but 'proxmox' → mylaptop is getting cut off. It seems like traffic from my laptop to proxmox is going through the switch, while from proxmox to my laptop it's passing through OPNsense. I notice the firewall logs show the default deny rule blocking the network settings. If I use an older router, everything functions properly.
X
XLottinskiX
02-24-2025, 04:40 PM #1

Hey everyone, I'm just getting started with OPNsense and hit a snag. The ping to 10.0.77.20 is fine, but accessing the web interface at 10.0.77.20:8006 gets blocked by the firewall. When I try 'mylaptop' → proxmox, it works, but 'proxmox' → mylaptop is getting cut off. It seems like traffic from my laptop to proxmox is going through the switch, while from proxmox to my laptop it's passing through OPNsense. I notice the firewall logs show the default deny rule blocking the network settings. If I use an older router, everything functions properly.

G
Gr33nFlar3
Member
158
02-28-2025, 07:50 AM
#2
Change your IPv4/CIDR from /32 to a subnet like /24 (255.255.255.0). It treats the vmbr0 interface as one network, so traffic to another client must go through the gateway. Using /32 limits ARP discovery to only what you explicitly specify or define in the ARP table, leaving the gateway as the sole knowledge of how to forward traffic.
G
Gr33nFlar3
02-28-2025, 07:50 AM #2

Change your IPv4/CIDR from /32 to a subnet like /24 (255.255.255.0). It treats the vmbr0 interface as one network, so traffic to another client must go through the gateway. Using /32 limits ARP discovery to only what you explicitly specify or define in the ARP table, leaving the gateway as the sole knowledge of how to forward traffic.