Hello, I am trying to make a VLAN in which clients can access the internet, but no other clients on the network. I have a VLAN, 192.168.134.0/24 setup with the MX IP being 192.168.134.1.
I then have two firewall rules, one to allow devices to connect to the MX for internet:
Allow -> Any Policy -> 192.168.134.0/24 -> Any Port -> 192.168.134.1/32 -> Any Port
And one to block all other traffic
Deny -> Any Policy -> 192.168.134.0/24 -> Any Port -> Any Destination -> Any Port
The problem is the device still can't connect to the internet. All network traffic is blocked, despite the first rule allowing connection the the MX device. If I remove that 2nd rule, I am able to access the internet, along with the rest of the devices on our network. This is for the wired portion of our network, so NAT mode from an AP is not an option. What am I doing wrong here?
I was also experimenting with group polices. I put the firewall rules in the group policy, and assigned the policy to the VLAN, however the group policy was never assigned to any devices in that VLAN.