Can you block access to Omada login page for VPN users?
Can you block access to Omada login page for VPN users?
Hello.
Is there a way to block VPN users (using Open VPN) from accessing the Omada login page when they are connected remotely? I can block them from accessing the login page of the NAS on the VLAN they are connected to by using an ACL (in the Switch ACL section) but not the Omada.
VPN users are on a seperate VLAN from the internal LAN.
Ports 80, 443, 8043, 8088, 8843 were selected in the ACL for the Omada rule but no luck.
Thank you.
- Copy Link
- Subscribe
- Bookmark
- Report Inappropriate Content
![](https://static-community.tp-link.com/icon/d992b79227f44913ac92e1d95b8e517c.jpeg)
Hi @daveydoom
Thanks for posting in our business forum.
1.1.0 firmware has been out for a week. I think it's already on the cloud and pushed to customers.
I created a VLAN interface that matches the subnet of the VPN client subnet. Currently, you cannot use GW ACL with IP Group. This will be a feature updated in the future.
But what I explained literally works.
The scheme is GW ACL, LAN to LAN.
Deny the VPN interface 10.10.20.1/24.
DST is the Management Web.
- Copy Link
- Report Inappropriate Content
Hi @daveydoom
Thanks for posting in our business forum.
Have you tried GW ACL? Or you can set up a Group to include the subnet of your VPN clients.
- Copy Link
- Report Inappropriate Content
@Clive_A Thank you for the response.
I haven't tried a Gateway ACL yet.
I did setup an IP-Port Group for the subnet of the VPN users. The ACL using that Group blocks access to the web login page for the NAS on that subnet but not the Omada itself. It seems like I'm missing (or overlooking) something very simple.
In your screenshot above, in the Destination section, how did you get an option for Gateway Management Page? I can't find that option using Gateway ACL or Switch ACL. It's not a Type of group that I can select.
- Copy Link
- Report Inappropriate Content
![](https://static-community.tp-link.com/icon/d992b79227f44913ac92e1d95b8e517c.jpeg)
Hi @daveydoom
What's the firmware version of your ER7212PC? Is it on the latest one?
I am using Omada Controller V5.12.2. If you don't find this, you can set it up manually by creating an IP-port group with your gateway and port included.
e.g. IP = 192.168.0.1/32 10.0.0.1/32 Port = 80, 443
In future firmware updates, that Gateway Management Page will be implemented.
- Copy Link
- Report Inappropriate Content
@Clive_A Thank you. An older firmware version is likely the reason for my problem. I don't have time to check at this moment but I am sure it's not the most recent one.
I won't have time to revisit this until later today or possibly tomorrow but I appreciate your help and will update once I have more info.
Cheers.
- Copy Link
- Report Inappropriate Content
@Clive_A My ER7212PC is running on firmware:
1.0.3 Build 20230314
Rel.21018
Controller is v5.8.22
I guess I am up to date after all and I am reluctant to install a beta version at this time. I will try to manually add the IP-Port Group as suggested although I think I already tried that without success. Will update you in a day or two.
Cheers.
- Copy Link
- Report Inappropriate Content
@Clive_A I tried again with all other ACL's disabled and I was able to get this to work (partially).
When logged in remotely to a laptop on that VPN user VLAN, I am unable to access the web login page for the NAS and the web login page for the Omada (using the gateway IP from both VLANs 30.30.30.1 and 192.168.68.1). This is good news.
However, when I make an actual VPN connection (using OpenVPN) I am still able to access the Omada login page using the gateway IP of 30.30.30.1.
EDIT:
I thought I read that the ER7212PC device will only allow 10 connections using L2TP and we're using those for staff (L2TP/IPsec with pre-shared key). Then a different connection method must be made for further VPN connections which is why we went with OpenVPN. But now I'm reading this:
Supports up to 20 x LAN-to-LAN IPsec VPN, 16 x OpenVPN, and 16 x L2TP/PPTP VPN connections.
I may have to change my course of action and use OpenVPN for staff and then the L2TP/IPsec with pre-shared key VPN option in Windows 10/11 for the other user group since they all require access to specific data.
- Copy Link
- Report Inappropriate Content
![](https://static-community.tp-link.com/icon/d992b79227f44913ac92e1d95b8e517c.jpeg)
Hi @daveydoom
Thanks for posting in our business forum.
1.1.0 firmware has been out for a week. I think it's already on the cloud and pushed to customers.
I created a VLAN interface that matches the subnet of the VPN client subnet. Currently, you cannot use GW ACL with IP Group. This will be a feature updated in the future.
But what I explained literally works.
The scheme is GW ACL, LAN to LAN.
Deny the VPN interface 10.10.20.1/24.
DST is the Management Web.
- Copy Link
- Report Inappropriate Content
@Clive_A Thank you for the info. I have updated the firmware and now just need some time to test this. I will report back once I find out more.
Regards, Dave
- Copy Link
- Report Inappropriate Content
@Clive_A A few questions if you please:
1) When you're testing and connecting using OpenVPN, are you using an OpenVPN profile you created on the router? Or are you using OpenVPN Access Server to control your connection?
2) In your Gateway ACL you indicated you're blocking 10.10.20.1 /24 but your screenshot shows you tried accessing 192.168.200.1. I setup my Gateway ACL the way you indicated and it blocks me from accessing 192.168.68.1 but still allows me to get to the Management page when I enter 30.30.30.1 when connected to that VLAN.
3) When connecting using an L2TP VPN connection I now lose internet access once the connection is made. This wasn't the case prior to the firmware upgrade. I didn't find nothing in the release notes referencing this so am unsure why that would happen. It doesn't happen when using an OpenVPN connection. Assuming I may now have to add DNS info in the optional field? I don't recall seeing that before.
- Copy Link
- Report Inappropriate Content
Hi @daveydoom
daveydoom wrote
@Clive_A A few questions if you please:
1) When you're testing and connecting using OpenVPN, are you using an OpenVPN profile you created on the router? Or are you using OpenVPN Access Server to control your connection?
2) In your Gateway ACL you indicated you're blocking 10.10.20.1 /24 but your screenshot shows you tried accessing 192.168.200.1. I setup my Gateway ACL the way you indicated and it blocks me from accessing 192.168.68.1 but still allows me to get to the Management page when I enter 30.30.30.1 when connected to that VLAN.
3) When connecting using an L2TP VPN connection I now lose internet access once the connection is made. This wasn't the case prior to the firmware upgrade. I didn't find nothing in the release notes referencing this so am unsure why that would happen. It doesn't happen when using an OpenVPN connection. Assuming I may now have to add DNS info in the optional field? I don't recall seeing that before.
1) If you see the OVPN software, and its profile.
2) If you could read it again. 10.10.20.1/24, what's the subnet of it? Two on the left is what I want to show.
3) What steps did you troubleshoot this? I don't know what you configured. There is no suggestion from me if there is a sentence to the symptom. It's the config then.
- Copy Link
- Report Inappropriate Content
Information
Helpful: 0
Views: 1453
Replies: 14
Voters 0
No one has voted for it yet.