Rules to allow Homekit across vlan

[RobbieTT]

@tknospdr
I use this 5353 UDP rule on my (IoT) VLAN and include IPv6:

login-to-view

I also have the somewhat odd-looking block rule below it just to stop the logs being spammed.

(My IoT / Untrusted network is called 'VLAN" and my main trusted LAN is called "LAN", with dedicated management on "MAN" - radical, I am not...)

Yes, HomeKit devices need to communicate directly with each other for some services (hand-off, iTunes server access, macOS etc) and for some device coordination, as well as direct comms to the hub.

️

[tknospdr]

@RobbieTT said in Rules to allow Homekit across vlan:

Yes, HomeKit devices need to communicate directly with each other for some services (hand-off, iTunes server access, macOS etc) and for some device coordination, as well as direct comms to the hub.

Sorry, I should have been more clear. I meant talk to other devices outside their own subnet that they initiate. I understand they'll reply to requests from outside per the way stateful works.

[RobbieTT]

@tknospdr
Outside of the Thread / Matter stuff the devices can be regular network clients and the examples I used are comms directly over the VLAN IPv6 network. They will still work without it but the services provided will be more limited.

For example, without the normal IPv6 connectivity an Apple HomePod will happily play Apple Music streamed via the WAN but it will not play a self-hosted (iTunes Home Sharing, port 3689) playlist hosted on a macOS client.

️

[moosport]

@RobbieTT said in Rules to allow Homekit across vlan:

@moosport

Did you add a port 5353 allow rule from your IoT VLAN to your main LAN?

️

No, I have not. Currently IoT vlan only has access to internet.
Is UDP 5353 only rule required? how to capture traffic to figure out what other rules are needed?

[tknospdr]

@RobbieTT

I have an unrelated question.
How do you host images directly on this forum for inline posting?

[rcoleman-netgate]

@tknospdr Copy/pasta

[tknospdr]

Testing image embed...

So these rules should be okay then?
login-to-view

Copy/pasta was too easy! I overlooked it.

[moosport]

@moosport said in Rules to allow Homekit across vlan:

@RobbieTT said in Rules to allow Homekit across vlan:

@moosport

Did you add a port 5353 allow rule from your IoT VLAN to your main LAN?

️

No, I have not. Currently IoT vlan only has access to internet.
Is UDP 5353 only rule required? how to capture traffic to figure out what other rules are needed?

login-to-view

Added this rule to IoT VLAN but devices cannot be discovered from Main VLAN to be added to Homekit.

[rcoleman-netgate]

@moosport Do you have avahi installed? mDNS is not an internet protocol -- it's multicast.

[moosport]

@rcoleman-netgate said in Rules to allow Homekit across vlan:

@moosport Do you have avahi installed? mDNS is not an internet protocol -- it's multicast.

yes, its installed and configured.

login-to-view
file:///home/netuser/Pictures/Screenshots/Screenshot%20from%202023-07-29%2021-19-13.png
login-to-view
file:///home/netuser/Pictures/Screenshots/Screenshot%20from%202023-07-29%2021-19-40.png
login-to-view

file:///home/netuser/Pictures/Screenshots/Screenshot%20from%202023-07-29%2021-20-00.png

[RobbieTT]

@moosport I would enable IPv6 support for mDNS / Avahi. It has become more of a 'presumed' capability for HomeKit, rather than merely an option with no drawbacks.

️

[moosport]

@RobbieTT said in Rules to allow Homekit across vlan:

@moosport I would enable IPv6 support for mDNS / Avahi. It has become more of a 'presumed' capability for HomeKit, rather than merely an option with no drawbacks.

️

Will that be just IoT VLAN or for both main and IoT VLAN?

[tknospdr]

I had to power cycle my pfS box and WAP today (was doing cable management...)
When everything came back up all my HomeKit devices were on wifi, but the Home app reported them as all offline.

I had to reenable my ANY rules and move them to the top of my ruleset in order to get everything back. When I had them enabled but at the bottom of the list a few devices kept randomly dropping.

This is pretty obvious evidence that there are some other ports/protocols that need to be allowed for a happy HomeKit experience.

Here's a pic of my full set of rules, can anyone tell me what might be missing?

login-to-view

[rcoleman-netgate]

@tknospdr said in Rules to allow Homekit across vlan:

I had to reenable my ANY rules and move them to the top of my ruleset in order to get everything back.

I would check your firewall logs for the things that are blocking them from communicating. I have no issues here but I also have limited HomeKit items and don't mind them being able to talk to many things.

Don't ask my other IoT devices what I think of them, though, they will hear you, reply, but they can't seek you out

[tknospdr]

@rcoleman-netgate
I've never parsed the logs in pfSense before.
What would I be looking for?

I checked out the logs and they're quite full of deny statements (obviously), how do I narrow down the scope of what I'm looking at?

[rcoleman-netgate]

@tknospdr Check for the IP of your device(s). Click the funnel (sieve) icon on the top to filter the logs.
https://docs.netgate.com/pfsense/en/latest/monitoring/logs/index.html

[tknospdr]

@rcoleman-netgate

Looks like the FW logs only keep the last 500 transactions.
I guess all the relevant entries fell off the bottom.
I got zero results for multiple IP addresses connected to IoT/HK devices that I know weren't responding.
Looks like I'll have to disable my any rules again and wait till things break once more.

The odd thing is I think they continue to work unless the wifi or power goes out, THEN they have issues reconnecting. So it might be some sort of initial handshake that's being rejected.

Shouldn't take too long, the power company is moving my whole city's lines from overhead to underground so our power has been doing weird crap for the past few weeks.

[johnpoz]

@tknospdr said in Rules to allow Homekit across vlan:

Looks like the FW logs only keep the last 500 transactions.

You can edit that

login-to-view

[tknospdr]

@johnpoz

Odd, I upped it to 3000 entries and searched for the IP address of my garage door opener which I specifically remember was not connecting to the home app.

There were no hits on it...

[johnpoz]

@tknospdr did you enable logging on pass rules? By default pfsense doesn't log allow rule traffic, only default deny.

Do you see the 5353 mdns traffic? That would be multicast destination.. I have a couple of threads around here about troubleshooting avahi.. And what rules you have to have to allow it to work.. and via sniffing validate that your traffic is being sent on, etc.

here is one of my troubleshooting avahi posts

https://forum.netgate.com/topic/166642/mdns-struggles/11?_=1691526954616