Management Page Block ACL blocks internet access
Hi support,
In continuation of a previous thread (locked) with similar topic:
https://community.tp-link.com/en/business/forum/topic/642230
I created an ACL as per link above, however, internet access will be blocked.
Followed the advice of the thread starter to allow TCP (instead of denying ALL protocol), still able to access the management page from the VLAN.
So any way to block management page from the VLAN without disrupting the internet access?
Thanks
Continue to experiment and seems to yield some positive result.
TLDR
- Only 1 deny / LAN-LAN / All protocol / VLAN to Gateway Management Page / ACL rule is needed @ Gateway
- For newly created LAN, do not use DNS=Auto setting
Background info
Secure LAN @ 192.168.0.1 (default network)
DNS: 1.1.1.3 / 1.0.0.3 (Using Cloudflare family DNS)
IPCam LAN @ 192.168.10.1 (VLAN ID @ 10)
DNS: Auto
ACL settings @ Gateway
With the above rule, the notebook will NOT be able to access the router UI page. Likewise, it cannot ping both 192.168.0.1 and 192.168.10.1 as well. However, IPCam LAN will lose internet access.
Observation
I observed that my notebook was issued with a DNS @ 192.168.10.1 which is expected since the VLAN was created with "DNS = Auto" setting. This maybe expected since with the deny ACL rule, the notebook is unable to ping the gateway @ 192.168.10.1. Performed a sainty check and tried pinging 1.1.1.3 and yes, it works.
Possible solution
So I went back to Settings -> Wired Networks -> LAN -> Edit IPCam DNS settings to be similar to Secure using Cloudflare Family DNS @ 1.1.1.3. And viola, internet works and it continue to block the router UI.
However, not too sure the above method will cause any security issues but so far, it's working as intended.
Thanks for your input.
However, your screen options seems to be different from mine.
Policy #1 - Allow
For direction, should I choose "LAN - LAN"?
And I can't seem to find "Service Type as DNS". Is this referring to protocol? Even so, I did not find any DNS over there.
Policy #2 - Deny
Likewise, "Service type as ALL" is referring to protocol?
See screenshot below, it does have "Management page" @ destination.
Continue to experiment and seems to yield some positive result.
TLDR
- Only 1 deny / LAN-LAN / All protocol / VLAN to Gateway Management Page / ACL rule is needed @ Gateway
- For newly created LAN, do not use DNS=Auto setting
Background info
Secure LAN @ 192.168.0.1 (default network)
DNS: 1.1.1.3 / 1.0.0.3 (Using Cloudflare family DNS)
IPCam LAN @ 192.168.10.1 (VLAN ID @ 10)
DNS: Auto
ACL settings @ Gateway
With the above rule, the notebook will NOT be able to access the router UI page. Likewise, it cannot ping both 192.168.0.1 and 192.168.10.1 as well. However, IPCam LAN will lose internet access.
Observation
I observed that my notebook was issued with a DNS @ 192.168.10.1 which is expected since the VLAN was created with "DNS = Auto" setting. This maybe expected since with the deny ACL rule, the notebook is unable to ping the gateway @ 192.168.10.1. Performed a sainty check and tried pinging 1.1.1.3 and yes, it works.
Possible solution
So I went back to Settings -> Wired Networks -> LAN -> Edit IPCam DNS settings to be similar to Secure using Cloudflare Family DNS @ 1.1.1.3. And viola, internet works and it continue to block the router UI.
However, not too sure the above method will cause any security issues but so far, it's working as intended.
Hi @BengGaBoy
Protocols, you can have more than 1. Or all. DNS is included as I recall.
If you set up like this, you of course do not have have any access to the gateway 80 and 443 anymore.
New VLAN interface, what DNS you set, will be assigned to the clients. If Auto, that defaults to the gateway IP and port 53.
BengGaBoy wrote
Thanks.
Just to check, which protocol(s) should I exclude to avoid the internet issue but still able to block management web GUI access?
Doesnt the Hank's answer you?? Regardless the protocols, use the destination gateway management page.
