Help Needed: Configuring Firewall Rules for School Network on IPFire

Network
1

Mālō e lelei from Tonga

We’re deploying IPFire across two educational campuses—ʻEua High School and Hofangahau College—and need guidance on configuring firewall rules that balance security with usability for students and staff.

Our setup includes:

  • Multiple VLANs (staff, student, guest)

  • Wi-Fi access points routed through IPFire

  • Web proxy and URL filtering enabled

  • Plans for VPN access and remote admin

We’d appreciate help with:

  1. Best practices for creating rules between VLANs (e.g. allowing staff access to student printers but blocking student access to admin systems)

  2. How to log custom rules for troubleshooting

  3. Tips for using country-based filtering or IP groups

  4. Any sample rule sets or templates for school environments

We’re aiming for a secure but flexible setup that supports learning and protects sensitive systems. If anyone has experience with IPFire in educational settings or similar deployments, your insights would be incredibly valuable.

Mālō ‘aupito!

2

Hi,
Let me share my experience with a school, in my case a primary school in Italy.
First, my configuration was much simpler; I didn’t have a VLAN.
My configuration was with a VPN and URL filters.

For URL filters, I invite you to follow the guide to ensure it also works for https sites.

I recently installed and enabled the RPZ component.

For the VPN, I previously used opnvpn, but recently I enabled Wireguard.
It’s easier to configure and install.