Internally route devices to WAN

[stephenw10]

Right so if you want only the laptop to see that view you'd set a single IP there rather than the subnet.

[johnpoz]

@stephenw10 yeah that was my first example with the /32 - but pretty sure he has multiple mobile devices, etc. Vs handing out specific IPs to devices and listing all the ips that you want to use the view, using a cidr is simpler.. Unless of course you have IPs in that range that you don't want to see the view.

[VioletDragon]

@stephenw10 I want multiple VLANs to see this, i.e Guest Network, LAN and WIFI network.

Regards

[VioletDragon]

@johnpoz Just a quick question, how can you do this for multiple VLANs?

[johnpoz]

@VioletDragon just set the view for whatever source IPs you want be that a /24 or a /20 etc.. you can also create multiple views, etc. if you want some range of IPs to get this result, and some other range of IPs to get a different one, etc.

[VioletDragon]

@johnpoz Yeah I have two VLANs one for Guest WI-FI and Private WI-FI. I am trying to figure out how to add those two into the views.

Regards

[johnpoz]

@VioletDragon well if your networks are next to each other or even if they are not just use a cidr that covers it..

For example if your networks were say 192.168.2.0/24 and 192.168.3.0/24 you could just a 192.168.2.0/23 which would include both of those networks.

If your networks are not adjacent you could still use a cidr to include them both.. Say you had

192.168.4.0/24 and 192.168.7.0/24 you could use a 192.168.0.0/21 to cover both of those - as long as you were not using any other network that falls under that cidr that you don't want to use the view.

I think you might be able to add multiple

access-control-view: 192.168.3.0/24 mailview
access-control-view: 192.168.7.0/24 mailview
access-control-view: 192.168.22.0/24 mailview

etc.. but I have not tested that specifically..

But I believe you can do that.. You could also just duplicate your view for your different network, call one mailviewA and the other mailviewB or something and then use your different access-control for each one, etc.

[VioletDragon]

@johnpoz Is this what I have done correct ? 10.10.10.20/24 is the VLAN for the Private WIFI connection.

Sorry I had to put this project on halt due to work and Christmas. Hope you had a great Christmas.

Regards

[johnpoz]

@VioletDragon if your client is on 10.10.10.0/24 then yeah any client would see that view 10.10.10.x or .y etc..

But your address is wrong a 81.1 is not a valid IP address you need 4 octets and see you have a " there at then end, did you just leave the rest of the IP off to post?

[VioletDragon]

@johnpoz Yes I removed the rest of the WAN IP for security purposeses. Is this correct though?

[johnpoz]

@VioletDragon but you have your full IP posted in a image above in the thread? Or did I just make up that IP?

I don't see your local zone for the domain and local data for the actual record.

Just scroll up - I posted a very explicit example of how to do it.

[VioletDragon]

@johnpoz That IP in the screenshot above isn't my IP.

[VioletDragon]

@johnpoz How does it look now?

[johnpoz]

@VioletDragon yeah that should work other than the invalid IP

[VioletDragon]

@johnpoz right awesome. Time to try it. Hopefully this doesn’t affect anything else except for that VLAN.

[VioletDragon]

@johnpoz Okay so that's worked however it seems to have broken pfblockerng

[VioletDragon]

@johnpoz Okay, I see what it's going now, It is rooting everything back to the WAN not just the domain name. But It also breaks pfblockerng on the WIFI devices.

[johnpoz]

@VioletDragon there is no way this breaks pfblocker.. Its 1 record, only for source IPs that are 10.10.10.x

I have no idea what your trying to do exactly - but not sure why you would want to point these clients to some public IP 81..

This is real simple does a client not from 10.10.10 network using unbound for its dns resolve what you want? And then does a client on 10.10.10.x asking for that same record get back what you created in your view?

[VioletDragon]

@johnpoz I am hosting a Mail Server internally, Web Mail is being Pointed to Load Balancers but when adding the Mail Server to the Mail Client internally it resolves to the Load Balancers. On Desktops computers or Laptops in order to get IMAP and SMTP working in the Mail Client I have to add mail.fqdn.com that points to the WAN Address in order for Mail Clients to work, of course external works because of DNS outside of the Network. The IP I am resolving too is the WAN IP Address.

I need to somehow route devices to the Mail Server or WAN IP to get IMAP & SMTP working.

Also all services that are under domain.com i.e Sub Domains are broken too.

When adding DNS Views it breaks pfblovckerng on that VLAN, All ads are no longer blocked.

[VioletDragon]

@johnpoz I need to figure out away to route mail.domain.com to a different IP and not the Load Balancers IP.