Skip to content

Configure Optional Interfaces

Optional interfaces (OPT1, OPT2, etc.) are additional network interfaces beyond the LAN/WAN pair. They are used for DMZ networks, server segments, guest networks, management networks, and any other segment that requires distinct firewall policy.

Prerequisites

  • A free physical NIC port, or a VLAN interface (see Configure VLANs)
  • A planned IP subnet that does not overlap with LAN, WAN, or any other interface

Step 1: Assign the interface

  1. Go to Interfaces > Assign
  2. In the available network interfaces list, locate the NIC port or VLAN you want to use
  3. Click Add to assign it as the next available optional interface (OPT1, OPT2, etc.)

Step 2: Configure the interface

Go to Interfaces > OPT1 (or the slot it was assigned to).

Field Notes
Enable Must be checked for the interface to be active
Description Rename from OPT1 to something meaningful (e.g., DMZ, MGMT, SERVERS)
IP address Assign the firewall's IP on this segment in CIDR notation (e.g., 192.168.20.1/24)

Bridge mode

Optional interfaces can be bridged with LAN, WAN, or another optional interface. Bridging merges the two segments at layer 2 — hosts on both interfaces share the same broadcast domain and IP subnet.

Bridge mode is incompatible with captive portal. Do not bridge an interface that runs captive portal.

IPv6 configuration

If IPv6 is enabled on the system:

Mode Notes
Disabled No IPv6 on this interface
Static Assign a static IPv6 address and prefix length
6to4 Auto-generate a /64 from the WAN interface's 6to4 prefix
DHCP-PD Prefix delegation from ISP; configure SLA ID and ISP prefix length

Router Advertisement (RA): Controls how this interface announces IPv6 autoconfiguration: - None — no RA sent; clients must be configured manually - Managed — RA sent, clients use DHCPv6 for address and config - Other — RA sent, clients use SLAAC for address, DHCPv6 for config only

Step 3: Enable DHCP on the interface (if needed)

Go to Services > DHCP Server and select the new interface tab. Enable DHCP and configure the address pool. See DHCP Server.

Step 4: Create firewall rules

By default, no traffic is permitted to or from an optional interface. All required rules must be added explicitly.

Go to Firewall > Rules and select the new interface tab.

Common patterns:

Allow optional interface hosts to reach the internet (outbound):

Action:   Pass
Interface: OPT1 (or your interface name)
Source:   OPT1 subnet
Dest:     any

Block optional interface from reaching LAN (isolation):

Action:   Block
Interface: OPT1
Source:   OPT1 subnet
Dest:     LAN subnet

Place this block rule above the pass rule to LAN. Ordering matters — first match wins.

Allow specific port from DMZ to LAN (e.g., only database access):

Action:   Pass
Interface: OPT1
Source:   DMZ server IP
Dest:     LAN DB server IP
Dest port: 5432

Step 5: Outbound NAT (if optional interface hosts need internet access)

By default (automatic outbound NAT), t1n1wall generates a masquerade rule for each internal interface subnet. The optional interface subnet should be included automatically.

If you have switched to advanced outbound NAT, add an explicit rule for the new subnet. See NAT: Advanced Modes.

Validation

  1. Connect a host to the optional interface segment
  2. Verify it receives a DHCP address in the correct range
  3. Confirm it can reach the firewall's OPT IP (e.g., ping 192.168.20.1)
  4. Confirm internet access works (if rules permit)
  5. Confirm it cannot reach LAN hosts (if isolation rules are in place)