PFSense Netgate 7100 Interface <> VLAN Problems

The most glaring problem with the rules in your original screenshot I can spot right away is setting WAN_1 net as the destination for rules that are supposed to grant internet access.

Think about what X net and X address actually means for any given interface X in pfSense. For example, assume the interface LAN is assigned the address 192.168.0.1 with the prefix /24. Then LAN address will be the same as 192.168.0.1/32 and LAN net will be the same as 192.168.0.0/24.

If you look at the subnet mask of your WAN_1 interface (Status → Interfaces), you’ll see that it doesn’t cover the entire internet, i.e. it’s not 0.0.0.0 (which would be /0 in terms of prefix length). So with WAN_1 net you are only covering a very small part of the internet, specifically the routers of other customers of your ISP. Naturally, addresses like 1.1.1.1 are not part of that network and your rule thus doesn’t allow access to them.

If you want a rule that allows access to the general internet, you will have to select something much broader for the destination. A bad practice which unfortunately many people apparently still do is to use any for the destination, which of course also allows access to all local networks, which is usually not intended. People would then precede this rule with rules blocking access to the individual local networks. But this has the drawback that if you ever added a new local network, you would have to make sure to update all interfaces’ rules to reflect that change, which is a lot of effort and has security implications if you forget to do it.

A much better approach is, as already suggested in this thread, to explicitly allow access to all destinations that are not part of any local network. For that, you create an alias containing all the addresses that could possibly be used in local networks. For IPv4, that corresponds to

Then you use this alias as the destination, but invert the match.

I personally never use reject rules in my configurations. pfSense by default rejects anything that you don’t specifically allow with a rule anyways, so this is in my opinion the best philosophy.