Firewall not dropping packets as expected

[HGME-JHJ]

I have the below firewall rules. There exist a 192.168.33.0/24 network on a separate vlan. This network is only to be reached from 192.168.11.0/24, and should no be able to reach the Internet or anywhere else. While capturing packets on LAN, I still see packets to and replies from outside ip-addresses. No group policy applied to the network in question. What am I missing here?

I have tried to make a dedicated deny rule for source 192.168.33.0/24, and although the hit counter increments I still see outside packets when capturing.

[ww]

Are you using autovpn? Is 192.168.33.0 is a vpn subnet? Is  a default route used in the vpn?

[HGME-JHJ]

No, 192.168.33.0 is not a VPN subnet.

[DarrenOC]

Hi @HGME-JHJ , can your 192.168.33.x hosts access the internet from internal network and can it be reached via hosts that aren’t n the 192.168.11.x subnet?

[HGME-JHJ]

I not sure about the 192.168.33.0/24, as the devices on this network is not available for me to test from. But I do have vpn access to the networks, and I am able to SSH into a SG300 switch in my management VLAN at network 192.168.128.0/24. From this switch I can ping both devices on other networks and targets on Internet, which neither should be possible. For instance I can ping from 192.168.128.11 to 192.168.11.10, which I intended to block.