Isolating VLAN from internet - Smoothwall

[howartp]

Ok, i'm stumped.

 

So our Cashless tills (NRS/Civica) are still on Win 7 so i'm moving them to a separate VLAN and blocking them from the internet per Cyber Essentials.

 

Done the new VLAN 21, un/tagged the ports, till has a 192.168.21.x IP address.

 

Smoothwall > Network > Firewall Rules > New rule (at the top of the top): Source IP is (.21.0 thru .21.254), all and everything, reject.

 

Save, apply, feed it chocolate, talk to it nicely, reboot it.

 

The till is still browsing random tech websites that i've likely never touched in school before without a hint of regret other than the SSL login page.

 

Why???

[strawberry]

Rule is enabled? Tills don't have wireless? Tills have the correct Gw?

[howartp]

Rule is enabled? Tills don't have wireless? Tills have the correct Gw?

Yes

No

The smoothwall is inline so regardless of gateway they can't possibly get on the internet without going through the gateway.

[TechMonkey]

Have you looked at the log? What rule does it say is letting that traffic go through?

 

Also, going for the basics, is the rule green ticked, and have you clicked save at the bottom of the rule page?

[Cache]

May or may not work - if the tills don't need Smoothwall to route any traffic to a different VLAN, why not just remove the VLAN from Smoothwall, remove the tagged connection from the switch to Smoothwall and then in theory no route out anywhere.

 

edit: posted and then realised it needs to be blocked at the boundry doesn't it? In which case, no other rule anywhere that is allowing those IP's access or an authentication policy applying to a location which is causing unexpected results?

Edited July 27, 2021 by Cache

[howartp]

The web filter is showing everything I'd normally expect, ie browsing normally from that IP address.

 

Firewall log is showing nothing coming from that IP address, including the firewall rule I created (and enabled logging) saying to reject it.

 

I did wonder about the VLAN tagging - in fact Smoothwall is NOT tagged into that VLAN and knows nothing of it, so even before I created the rule I did think maybe it shouldn't let browsing happen.

 

Confused.com

[howartp]

Firewall log is showing nothing coming from that IP address, including the firewall rule I created (and enabled logging) saying to reject it.

Just changed the rule to Accept, then ran a ping from the till which showed up in the log. All the values were as I'd expect.

 

Changed it back to Drop then ran ping again - which it blocked.

 

Then tried to browse - which still worked.

 

So it looks like the firewall doesn't get involved with outgoing web traffic as presumably the proxy takes over.

 

I've therefore created a Location for the VLAN IPs and used a Location Block to block web browsing, which is now working.

 

Thanks for everyone's replies confirming I wasn't missing simple things.

[ibpalle]

Correct, if there is a transparent proxy on the VLAN interface, web traffic will be handled by the proxy, not the firewall rules. If the transparent proxy is not needed on the interface, it can be removed.