Ok, yep, it can be easy to lock yourself out during setup.
I would say first, you need to create a ‘Remote dial-in user’ VPN connection to each remote site, so you can always get back in and undo anything you have accidentally changed; like you did when testing.
You can always use your phone to do this and have each router in a list that you can simply click-on, establish a connection, make amendments and then disconnect. (You may need to disable your phone’s wifi connection before dialling in though; to place you outside your local VPN bubble)
Firewall:
The FW rules work in order, starting from Set#1 Rule#1 through to Set#12 Rule#7 (for the 2927), so if you place a rule in Set#1 Rule#1 that blocks everything immediately, any rules after that rule will never run. Although, if you choose to ‘Block if no further match’, then the block will only happen if there are no ‘Allow’ rules thereafter.
I prefer to use the firewall in a slightly differently way from that one. Instead, I place a ‘Block immediately’ rule, in say, position Rule#7 of Set#1 and any rules earlier than that rule are my allow rules, if you want more allow rules, you can place the block rule at position Set#2 Rule#7, giving you 13 earlier allow rules to use.
One thing to note here, the sets aren’t all active by default, you have to add them to the order of play.
In the ‘General setup’ page of the Firewall, you will see the ‘Data Filter’ enable/disable radio buttons and the ‘Start Filter Set’ preference. That selected Set# is where the rules will start in order from. Once a Set has run, it jumps to the next Set, which is selected at the bottom of each Set page; see bottom right-hand corner of each Set page. If no “Next Set#” is specified, the Data Filter rules finish there and the ‘Default Rule’ then runs.
So you could have just two rules in place, say Set#7 Rule#1 configured and be the first rule to ever run and then maybe Set#4 Rule#7 as the next rule that is reached and run.
Simply put, the order matters. If you lose track of the order that the rules run in, you’ll get tied up in knots and mis-configure the Firewall.
In each rule that you setup, be aware that rules execute in one direction (left pane to right pane) see ‘Direction’ ->> ‘Advanced’ button, if you don’t grasp this, you won’t understand why it’s not working. Also, you CAN’T block traffic between nodes on the same LAN#; unless it is a dial-in VPN user joining a LAN#, in which case, it’s then actually a VPN connection rather than a LAN connection so rules can be applied.
The reason I mention not being able to set a rule on the same LAN, is because you may want to create a single block rule for ALL LANs, or a selection of LANs (and the VPN) in one rule and you’ll be ticking say LAN1 to LAN2 and also LAN2 to LAN1 which looks like it will also apply to LAN1 to LAN1 and LAN2 to LAN2, but it won’t, as that can’t happen, so don’t be put-off by seeing this and thinking that.
