Firewall/NAT

noob ?s

I am setting up monowall with the internal lan on LAN using 192.168.1.x
The OPT1 is for a captive portal
I have a rule in place blocking OPT1 to LAN traffic

2 questions:
1. my understanding is that LAN traffic between computers cannot be blocked by the firewall, as the computers communicate on the physical layer.  However, traffic between OPT1 and LAN can be controlled/blocked by the firewall.  Can someone confirm that is correct?

2. LAN traffic is on 192.168.1.x.  Does it make any difference if the OPT1 traffic is on 192.168.10.x, vs. 172.16.0.x?

thx!

That is correct.  Traffic between PCs on the LAN go direct from PC to PC as they are on the same subnet, it doesn't even touch the router.  If you wanted to control this traffic you would be best using some kind of corporate firewall software controlled by policy.  Or possible some expensive network switch. The opt1 interface subnet will not make any difference, as it goes through the firewall to talk to anything outside it's subnet.