Block connection to internet but allow LAN communictation

[Robthesoundguy]

I've got a MX64 and MS120-8 in a waste water treatment plant with two vlans. One for data and one for controls.

The machine that controls the PLC's and other equipment lives on the controls vlan and needs internet access, but the rest of the equipment on that vlan doesn't need access. 

What I'm having trouble determining is how to block just internet access for the PLC's and other equipment, while still allowing them to communicate on the LAN. 

Any ideas are appreciated. 

[jdsilva]

This is best done using the L3 firewall rules on the MX. You rules should look something like this:

Allow you internal networks to your internal networks 

Allow the source IP of the devices you want to get Internet to "Any"

Deny any to any 

[NolanHerring]

On the connection between the MX64 and MS120, assuming you have it set to trunk mode, only allow the VLANs that you want to have internet.

Layer 2 VLANs that reside on the switch, say you just created VLAN 500 to test with for example, won't be able to go across unless your allowing VLAN 500 on the switch uplink/MX downlink ports.

Are you using the MX64 for DHCP for the VLANs that don't need Internet?

If so, then on the outbound firewall rules, assuming you have a specific subnet for the VLANs you don't want to go out to the Internet, just add on the firewall outbound rules

Deny the entire subnet to any outbound destination.

[Robthesoundguy]

Thanks for the suggestion. I was over-thinking the solution.

I created two rules: 

1: Allow any/any for the machine 

2: Deny any/any for the entire controls subnet

[BrechtSchamp]

Note that this also means that your PLC's won't be able to initiate connections to the "machine". This is fine if all communication is initiated from the "machine" (because the firewall is stateful), but if not, you're better off doing what @jdsilva said. E.g. PLC needs to get a new firmware over TFTP from the "machine".