I'm trying to create a sandboxed virtual network that has access to the internet from my physical home network/router. I have got so far but need a bit of assistance.

The pfSense firewall/router VM is configured with two virtual network adaptors, em0/WAN being the physical home network/router with an IP range of 192.168.0.x and em1/LAN being the virtual network with a network range of 192.168.1.x.

So far the router VM is working as the gateway, DHCP server and DNS forwarder but any test VMs I create can still ping IPs within the 192.168.1.x range, which I'd like to avoid as that means the virtual network isn't fully sandboxed. I have tried enabling "Block private networks" on the LAN adaptor (em1) but this seems to prevent any test client VMs from accessing the router all together, even internet access.

Can someone please point out what I am doing wrong? Am I going to have do do something with VLANs to achieve this? If so, how?

its been long since I used pfsense ,but if you just want to stop ping from outside check for options in pfsense it is possible.
It would be easy if you are using GUI mode.

nm

Check that you do not have an any to any or lan net to lan net rule in your lan rules table.

I have attached a screenshot so you can get a general idea. This is done on a test box not connected to internet but also runs pfsense in a vm.

On my system pings are blocked. Remember on pfsense everything is blocked unless explicitly allowed.

Attached Thumbnails