Question #1

So the first question is all about why devices are allowed to connect to my Plex server which is on a different VLAN. My Plex server's IP address is 192.168.0.70. My TV's IP address is 192.168.20.109. I only use my TV to watch Plex at night while I'm studying (lower power consumption by not having the xbox + receiver on since I keep it muted). The usual way I watch Plex is through my Xbox which is on the "Main" network, which has a firewall rule to allow traffic to travel across networks via a simple "allow Main to any" rule. What I'm confused about is why my TV (IoT network) is allowed to connect to my Plex server when the only two firewall rules I have for that network is "allow dns" and "allow !RFC 1918". That network should ONLY have access to the internet and nothing else. What I'm thinking is that maybe my port forward rule I created for Plex is allowing the TV to connect to my Plex server? Everything works the way I want it to currently. I would rather not have to create multiple rules to allow devices to connect to Plex. Is allowing all devices on any subnet to connect to a specific IP on a specific port ok? I'm sure if I change "source" to "WAN", I wouldn't be able to connect to Plex via the TV any longer and that would require the creation of new firewall rules for every network.

Question #2

After hearing about the whole LG tv recording conversation and phoning home with it, I wanted to block my TVs ability to do that. I tried creating a firewall rule to "block RFC !1918" and it worked, the only issue is that I can't open any of the apps while that firewall rule is enabled. I'm assuming there is no easy way to allow my TV to be able to play stuff from my Plex server while keeping it from also connecting to the internet. I know Plex needs to authenticate over the internet, but I already have all my stuff set up to allow connections without auth (which I'm fine with for the TV since I'm the only one who uses it). I know that setting logs you in with admin privileges and I'm fine with it. I'm assuming the only way to get this to work is to very meticulously go through the firewall live view and try to figure out the IP address needed to load the "home" screen so apps actually load? I would be interested in hearing how you guys block internet access to your TVs or other devices while still allowing local connections.