OPNsense DMZ Firewall Rules for IoT

Thu, 30 Apr 2026 00:00:00 +0000

OPNsense DMZ Firewall Rules for IoT#

What Was Established#

A structured firewall rule set for isolating IoT devices in a DMZ zone. The rules enforce a “high-to-low trust” flow, ensuring IoT devices can reach the internet for cloud services while preventing them from initiating connections to the trusted LAN. This pattern is critical for preventing lateral movement from compromised IoT devices.

Key Decisions#

Explicit Allow / Implicit Deny: Only allow necessary outbound traffic (HTTP/HTTPS, DNS, NTP) from DMZ to WAN.
Strict Containment: Explicitly block all DMZ-initiated traffic to the LAN zone.
Controlled LAN Access: Default deny for LAN-to-DMZ, with specific allow rules only for administration or required services.
WAN Isolation: Block all unsolicited inbound traffic from WAN to DMZ.

Current Configuration#

Note: The homelab currently uses VLANs (Gandalf 192.168.1.x, Mithrandir 192.168.2.x, Tharkûn 192.168.3.x, Rivendell 192.168.4.x) managed by a UniFi Express gateway (“Olorín”, 192.168.1.1). These OPNsense zone-based rules should be adapted to the homelab’s VLAN structure or applied to a dedicated IoT VLAN (e.g., 192.168.50.x).

Dmz on homelab

OPNsense DMZ Firewall Rules for IoT

OPNsense DMZ Firewall Rules for IoT#

What Was Established#

Key Decisions#

Current Configuration#