Then I have a floating rule on all the interfaces inbound that passes traffic for TCP/UDP 53 to an alias with these two DNS servers defined. It's a pain to have all the rules different so I tell all the DHCP instances to give the same two DNS servers to clients on all VLANs. I use a floating rule for DNS access for several captive portal VLANs. I have found that while the rules are similar, usually different interfaces require different things. Where the rules are identical, you can use an interface group or a floating rule. That's why I thought maybe using interface group / aliases, there's a way of doing it smartly.

That means I need to go through all those vlans and I'm bound to forget one. Most importantly, if I ever want to change settings. There's probably a better way of doing it and that I just don't know how. But I think I'm just doing it in a dumb way. This bit that you link from the documentation. This isn't possible if both clients are on the same subnet and switch.' 'A prime example of this is trying to keep one system on the LAN from accessing another system on the same LAN.

I haven't had the time to look into it yet as I can't connect to my switch at the moment. I recall that you said I should use private vlan edge (protected ports) to isolate the vlans. Also talks about adding a rule for the network to be able to communicate with itself. The guide here on the section 'Private No-Internet VLAN'. Then from my machine 10.20.13.12, I ping the vlan ip which is 10.20.13.1 and it works only when the rule is enabled. Maybe I'm doing something else wrong? I set to allow icmp from vlan10 to vlan10. I'm pretty sure my rule 1 work… because I tested it via disabling/enabling it.

Pfsense inter vlan routing