[withinboredom]

I’ve had to do it fairly recently due to a lot of dynamic bridges and routing on the internal network vlan. I wanted to allow all traffic through the vlan from any device. However, wanted a default drop on the external interface.

[X-Istence]

Once you are working with VLAN's you are out of the bailiwick of consumer hardware, and you should be looking at more enterprise grade gear.

At that point having a default drop on the external interface and different rules for traffic traversing VLAN's is entirely possible, in fact that is what it is designed and built to do.

[withinboredom]

My consumer router has vlan support…