ER605 Access Control Question (Block WAN to specific VLAN but allow other LAN)

ER605 Access Control Question (Block WAN to specific VLAN but allow other LAN)

ER605 Access Control Question (Block WAN to specific VLAN but allow other LAN)
ER605 Access Control Question (Block WAN to specific VLAN but allow other LAN)
2024-07-21 05:45:52 - last edited 2024-07-29 01:08:45
Model: ER605 (TL-R605)  
Hardware Version: V2
Firmware Version: 2.2.2 Build 20231017 Rel.68869

On my ER605 I have a Cameras VLAN set up, which I have on the 192.168.5.0/24 IP range. I have a separate wireless TP-Link router as the 192.168.5.1 gateway on this port (one of the mesh routers, I forget the exact model) which I have all of my in-house cameras wirelessly connected to.

 

I also have OpenVPN set up on the ER605 to provide IPs on the 192.168.6.0/24 IP range, which seems to be working (after connecting to OpenVPN my device lists a 192.168.6.10 IP, I can get access to webpages while connected, and I see traffic for that IP in the Traffic Listings page), so that seems to be working fine.

 

My issue comes with getting the Access Control for this set up to work correctly. Something about this just doesn't seem to be clicking in my mind. My goal is to have all of the cameras be completely inaccessible from WAN and vice-versa, but accessible to devices connected via OpenVPN. To that end, I have this set of rules:

Camera_VLAN_Group = 192.168.5.0/24, OpenVPN_VLAN_Group = 192.168.6.0/24, and Chris_Machines is my desktop that I have on another port on the ER605, which shouldn't be impacting anything I'm asking about but I'm including the associated rules for completeness' sake.

 

I am very confused as to why this set of rules isn't working the way I think it should, which is to (1) allow traffic between the VPN and Camera VLANs and (2) prevent any WAN access for Camera. To be clear, part (2) is working, but part (1) is not; I do not have any access to the cameras on the OpenVPN connected device. It doesn't seem to matter which order I have these 4 rules in, the end result always is that the cameras have no access to WAN but the OpenVPN device has no connection to the cameras. I can access the cameras just fine if I change rules 5 and 6 to Allow instead of Block, but that obviously defeats the purpose.

 

I think my issue is just a fundamental misunderstanding of how these rules are supposed to work. Can someone give me a hand?

  0      
  0      
#1
Options
1 Accepted Solution
Re:ER605 Access Control Question (Block WAN to specific VLAN but allow other LAN)-Solution
2024-07-27 23:43:47 - last edited 2024-07-29 01:08:45

  @Clive_A 

Finally figured it out. Nothing I was trying regarding the ACLs would work, not even your suggestion, until I tried using OpenVPN ( I had been trying Wireguard) and enabling Full Mode. That was the entire fix. After that, I had access to my cameras from the VPN client, and I could then set ACLs as appropriate.

Recommended Solution
  1  
  1  
#6
Options
5 Reply
Re:ER605 Access Control Question (Block WAN to specific VLAN but allow other LAN)
2024-07-22 01:20:34

Hi @ewe_ewe 

Thanks for posting in our business forum.

ACL is not effective for the VPN clients.

 

A workaround that the community users brought up is that you can try to set up the OVPN clients to get the VLAN interface(which you create for the VPN clients). There, when they have same subnet and IP address, ACL might be effective for what you need to do.

You can try this but is not guaranteed to work. I recall someone mentioned this.

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Official and Beta firmware. NEW features! Subscribe for the latest update!Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting ★ ☚ ● Be kind and nice. ● Stay on the topic. ● Post details. ● Search first. ● Please don't take it for granted. ● No email confidentiality should be violated. ● S/N, MAC, and your true public IP should be mosaiced.
  0  
  0  
#2
Options
Re:ER605 Access Control Question (Block WAN to specific VLAN but allow other LAN)
2024-07-22 05:57:08

  @Clive_A Thanks for getting back to me!

 

I'm sorry, but I'm afraid I don't understand this part:

"set up the OVPN clients to get the VLAN interface(which you create for the VPN clients)"

 

The router is already set up with a separate VLAN for the OpenVPN connections and a separate VLAN for the Camera network. Are you saying I should drop the OpenVPN VLAN entirely and just associate the OpenVPN connections to the Camera VLAN/subnet directly?

  0  
  0  
#3
Options
Re:ER605 Access Control Question (Block WAN to specific VLAN but allow other LAN)
2024-07-22 22:50:52 - last edited 2024-07-22 22:51:37

@Clive_A 

 

That must not have been what you were suggesting, because that doesn't seem to work either. I have the VPN assigning a static IP (192.168.5.254) in the same subnet as Camera (192.168.5.0/24), and there's still no access to the actual cameras (e.g. 192.168.5.5), which is very confusing because I have no ACLs for any intra-VLAN traffic there. I would have thought that being on the same subnet and VLAN I'd have no trouble at all accessing them. I know the cameras are active, if I directly connect to the their network I can see through them. I can allow or disallow WAN access to the VPN connected device while it's on the 192.168.5.0/24 IP pool with a specific targeted ACL, so ACLs must have at least *some* impact on devices connected via VPN, but access to the cameras is still for some reason impossible.

 

I've looked but I can't find the thread you're referencing for the workaround you mentioned, could you explain it a bit more?

  0  
  0  
#4
Options
Re:ER605 Access Control Question (Block WAN to specific VLAN but allow other LAN)
2024-07-23 01:41:23

Hi @ewe_ewe 

Thanks for posting in our business forum.

ewe_ewe wrote

  @Clive_A Thanks for getting back to me!

 

I'm sorry, but I'm afraid I don't understand this part:

"set up the OVPN clients to get the VLAN interface(which you create for the VPN clients)"

 

The router is already set up with a separate VLAN for the OpenVPN connections and a separate VLAN for the Camera network. Are you saying I should drop the OpenVPN VLAN entirely and just associate the OpenVPN connections to the Camera VLAN/subnet directly?

Create a VLAN interface for VPN client purposes only.

The VPN IP should use IPs from this interface.

 

Then, create the ACL should be configured as LAN>LAN. Scheme should be pretty much what you have now.

 

This was something discussed on the forum. Someone mentioned it worked.

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Official and Beta firmware. NEW features! Subscribe for the latest update!Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting ★ ☚ ● Be kind and nice. ● Stay on the topic. ● Post details. ● Search first. ● Please don't take it for granted. ● No email confidentiality should be violated. ● S/N, MAC, and your true public IP should be mosaiced.
  0  
  0  
#5
Options
Re:ER605 Access Control Question (Block WAN to specific VLAN but allow other LAN)-Solution
2024-07-27 23:43:47 - last edited 2024-07-29 01:08:45

  @Clive_A 

Finally figured it out. Nothing I was trying regarding the ACLs would work, not even your suggestion, until I tried using OpenVPN ( I had been trying Wireguard) and enabling Full Mode. That was the entire fix. After that, I had access to my cameras from the VPN client, and I could then set ACLs as appropriate.

Recommended Solution
  1  
  1  
#6
Options

Information

Helpful: 0

Views: 448

Replies: 5

Related Articles