Block connection to internet but allow LAN communictation

Here to help

Block connection to internet but allow LAN communictation

I've got a MX64 and MS120-8 in a waste water treatment plant with two vlans. One for data and one for controls.

The machine that controls the PLC's and other equipment lives on the controls vlan and needs internet access, but the rest of the equipment on that vlan doesn't need access. 


What I'm having trouble determining is how to block just internet access for the PLC's and other equipment, while still allowing them to communicate on the LAN. 


Any ideas are appreciated. 

Kind of a big deal

This is best done using the L3 firewall rules on the MX. You rules should look something like this:


Allow you internal networks to your internal networks 

Allow the source IP of the devices you want to get Internet to "Any"

Deny any to any 

Kind of a big deal

On the connection between the MX64 and MS120, assuming you have it set to trunk mode, only allow the VLANs that you want to have internet.

Layer 2 VLANs that reside on the switch, say you just created VLAN 500 to test with for example, won't be able to go across unless your allowing VLAN 500 on the switch uplink/MX downlink ports.

Are you using the MX64 for DHCP for the VLANs that don't need Internet?

If so, then on the outbound firewall rules, assuming you have a specific subnet for the VLANs you don't want to go out to the Internet, just add on the firewall outbound rules

Deny the entire subnet to any outbound destination.
Nolan Herring |

Thanks for the suggestion. I was over-thinking the solution.


I created two rules: 


1: Allow any/any for the machine 

2: Deny any/any for the entire controls subnet



Note that this also means that your PLC's won't be able to initiate connections to the "machine". This is fine if all communication is initiated from the "machine" (because the firewall is stateful), but if not, you're better off doing what @jdsilva said. E.g. PLC needs to get a new firmware over TFTP from the "machine".

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.