How to filter traffic between two networks while also allowing outbound to the Internet

[safari7279]

Hello kind people of the internet!
I am a little confused on how to approach this and thought I would ask here before sending the wrong packets to the wrong place.

I have two networks
LAN - 192.168.0.0/24
IOT - 192.168.1.0/24

I want to allow my computer on the LAN network (192.168.0.50) to access a device on the IOT network (192.168.1.100) at TCP port 8080
But I also want both networks LAN and IOT to be able to reach to the public Internet via NAT
Everything else should be blocked

I see two approaches

---------
First one is to filter on the pass in rule

ext_if = "em3"
lan_if = "em0"
iot_if = "em1"

lan_net = "192.168.0.0/24"
iot_net = "192.168.1.0/24"

nat on $ext_if inet from { $lan_net $iot_net } to any -> ($ext_if)

block all
pass out quick inet

pass in on $lan_if inet from $lan_net to !$iot_net
pass in on $lan_if inet proto tcp from 192.168.0.50 to 192.168.1.100 port 8080
pass in on $iot_if inet from $iot_net to !$lan_net

---------
Second is to filter on the pass out rule.

ext_if = "em3"
lan_if = "em0"
iot_if = "em1"

lan_net = "192.168.0.0/24"
iot_net = "192.168.1.0/24"

nat on $ext_if inet from { $lan_net $iot_net } to any -> ($ext_if)

block all

pass in on $lan_if inet from $lan_net to any
pass out on $ext_if inet from $lan_net to any

pass in on $iot_if inet from $iot_net to any
pass out on $ext_if inet from $iot_net to any

pass in on $lan_if inet proto tcp from 192.168.0.50 to 192.168.1.100 port 8080
pass out on $iot_if inet proto tcp from 192.168.0.50 to 192.168.1.100 port 8080

---------

I plan on adding more networks in the future and I fear the first approach (filter on the pass in with a general pass out all) will get confusing over time.

 

[SirDice]

Instead of $lan_net and $iot_net you can use $lan_if:network and $iot_if:network, that will automatically pick up the configured network segment of the interface.

           Interface names and interface group names, and self can have
           modifiers appended:

           :network      Translates to the network(s) attached to the
                         interface.
           :broadcast    Translates to the interface's broadcast address(es).
           :peer         Translates to the point-to-point interface's peer
                         address(es).
           :0            Do not include interface aliases.