Allow new connection one way, block new connections the other way. (between vlans)

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Allow new connection one way, block new connections the other way. (between vlans)
Allow new connection one way, block new connections the other way. (between vlans)
2021-08-20 14:36:01 - last edited 2021-08-23 16:46:14
Model: ER7206 (TL-ER7206)  
Hardware Version: V1
Firmware Version: 1.1.1

Goodafternoon.

 

Last week I dove in to Omada, as a good replacement for my pfSense setup that was running on my server.

The short reason behind is, when I needed to update the server, I wont have any internet access. Together with the comming of 1gbit fiber, I found it a good idea to set this up.

 

Sofar my experience has been great, I see that some stuff is still mising, or nog fully finished. One of these I want to point out.

 

As noted above, I have the router 7206. Where Wan & Wan/Lan 1 are my Wan ports, and Wan/lan 2, Wan/lan 3 & LAN are my lan ports. 

I currently have connected my server directly to my router on Wan/lan 2 and my switch (SG2008P) on LAN. 

 

To block traffic between vlan's I have setup Switch ACL. But what I want to do: Block connection made from Linux VLAN to Windows VLAN, but allow connection made from Windows VLAN to Linux VLAN. To manage the Linux servers. The same goes for connections made from Linux/Windows to Lan should be blocked, but connection made from LAN to Linux/Windows should be allowed.

 

Any tips on how to set this up in the omada software?

 

I also noticed that Switch ACL doesn't apply between LAN ports on the router, would be nice if that worked to. 

  1      
  1      
#1
Options
1 Accepted Solution
Re:Allow new connection one way, block new connections the other way. (between vlans)-Solution
2021-08-20 14:49:04 - last edited 2021-08-23 16:46:14

@KingHorse 

 

Hey

 

By blocking the traffic between the VLANs you are going to stop all communication.  The Windows VLAN can send to the Linux VLAN, but it in turn cant reply and even PING will fail

 

The only way I can see this being possible is to add an exception for traffic out (an allow rule) from the Linux VLAN with the ports, protocols or IPs you feel require that traffic..  specifically define it and apply that higher than the block VLAN.

 

Under settings, profiles, groups you could do this then apply to the ACL as allow.    If it's complete traffic from the Linux Servers do it via IP address, if its just RDP or similar then open the necessary ports back.

 

I had to do the same for my CCTV that is on its own VLAN and isolated.  To allow my PC to view the cameras I opened the TCP UDP traffic and ports for that specific purpose.. screenie below

 

 

That help any?

 

Recommended Solution
  1  
  1  
#2
Options
6 Reply
Re:Allow new connection one way, block new connections the other way. (between vlans)-Solution
2021-08-20 14:49:04 - last edited 2021-08-23 16:46:14

@KingHorse 

 

Hey

 

By blocking the traffic between the VLANs you are going to stop all communication.  The Windows VLAN can send to the Linux VLAN, but it in turn cant reply and even PING will fail

 

The only way I can see this being possible is to add an exception for traffic out (an allow rule) from the Linux VLAN with the ports, protocols or IPs you feel require that traffic..  specifically define it and apply that higher than the block VLAN.

 

Under settings, profiles, groups you could do this then apply to the ACL as allow.    If it's complete traffic from the Linux Servers do it via IP address, if its just RDP or similar then open the necessary ports back.

 

I had to do the same for my CCTV that is on its own VLAN and isolated.  To allow my PC to view the cameras I opened the TCP UDP traffic and ports for that specific purpose.. screenie below

 

 

That help any?

 

Recommended Solution
  1  
  1  
#2
Options
Re:Allow new connection one way, block new connections the other way. (between vlans)
2021-08-22 00:26:23

@KingHorse 

 

There is no way to add stateful firewall rules to the Omada system right now. I have asked about it in a few threads, but so far nothing. If you need that feature today you will need to get a different gateway router/firewall.

  2  
  2  
#3
Options
Re:Allow new connection one way, block new connections the other way. (between vlans)
2021-08-23 16:47:47

@Philbert Thanks for your reply! Just what I needed. All working as intended. Have had a busy weekend. Not much time to spend.

 

I will wait patiencly on the next updates. 

  0  
  0  
#4
Options
Re:Allow new connection one way, block new connections the other way. (between vlans)
2021-08-23 16:49:44

@Jackace Totally understand, that this system has his limitations. But with the tips of the other post, I was able to get a solution working. Networking is still sometimes a mind breaker.laugh

  0  
  0  
#5
Options
Re:Allow new connection one way, block new connections the other way. (between vlans)
2021-08-23 17:02:38

@KingHorse 

 

That other solution provided will work to get you connectivity, but from a security standpoint you now have a hole in the ACL between your Vlans. Which is not ideal if all you need is to remote manage the devices. Stateful Firewall rules work much better for that type of thing, but as of right now they are not supported.

  2  
  2  
#6
Options
Re:Allow new connection one way, block new connections the other way. (between vlans)
2021-08-23 17:11:38

@Jackace 

 

100% agree, we should have stateful firewalls in Omada.. hopefully, some day that pipe dream will arrive!   

 

Sadly stuck with protocols and ports open until such time however!  indecision

  1  
  1  
#7
Options