pfSense Firewall Rules Explained: Network Isolation, Rule Order, and Traffic Logs

In this pfSense firewall rules tutorial, we build a practical home lab network using VirtualBox, pfSense, Oracle Linux 9, and an Alpine Linux fake IoT VM. The goal is simple: create a separate IoT network, allow that IoT device to reach the internet, block it from reaching the private LAN, and prove the block using pfSense firewall logs. The biggest lesson in this video is rule order. pfSense reads firewall rules from top to bottom, and the first matching rule wins. If your rules are in the wrong order, you can accidentally allow traffic you meant to block. Lab setup used in this video: Private LAN: Network: 172.16.40.0/24 pfSense LAN IP: 172.16.40.1 Admin VM: Oracle Linux 9 IoT Network: Network: 172.16.20.0/24 pfSense IoT IP: 172.16.20.1 Fake IoT VM: Alpine Linux / smartcam01 DHCP Range: 172.16.20.100–172.16.20.200 DNS: 1.1.1.1 What you’ll learn: How to create an IoT network in pfSense How to use a VirtualBox internal network as an IoT segment Why new pfSense interfaces block traffic by default How firewall rule order works in pfSense Why “first match wins” matters How to block IoT traffic from reaching your private LAN How to allow IoT traffic out to the internet How to verify blocked traffic using pfSense firewall logs Final firewall policy: 1. Block IoT net to LAN net 2. Allow IoT net to any The order matters. Put the specific block rule above the broad allow rule. If you’re building a cybersecurity home lab, this is where pfSense starts becoming a real firewall instead of just a router. Network segmentation, rule order, and log validation are foundational skills for network security, SOC analysis, and real-world troubleshooting. Netsectap — Practical Cybersecurity Training, Built for the Real World. #pfSense #FirewallRules #Cybersecurity #HomeLab #Networking #VLAN #NetworkSecurity