Allowing Vlan access to single IP outside Vlan
-
Trying to lock down a couple of my vlans a little more but still allow access to a printer that is outside of the vlan. This is how I have it setup and seems to me it should work but not sure why it doesn't.
Any help or a point in the right direction would be great.
-
You need to be a bit more specific, for example: What exactly is working, but you think it shouldn't be?
Give specific examples of client IP addresses as sources and destinations of traffic, the specific protocol being tested (e.g. ping) and so on. Also note any packages you may have installed, as they could affect the traffic being passed.
Without details it's difficult to speculate, but it could be anything from an existing state passing traffic if you're testing with ping, to squid passing the connection through a proxy to the other subnet(s).
-
@jimp Sure thanks for the quick reply.
The adminguest network is attached to an AP that I want to keep open just for the occasionally guest that may need internet for a presentation or what not. The screen shot above is of the rule set for that network. it is 10.0.23.0 and the main Lan is on a 10.0.0.0 scheme. I don't want the guests to have full access to LAN except for access to a printer which is 10.0.0.240.
I have a rule blocking all traffic LAN net which is 10.0.0.0 and one blocking to Video Net with is another Vlan that has security cameras for this business.
The top rule is allowing any traffic to destination ip 10.0.0.240 . I have tried pinging and httping to the ip from the ADMINGUEST net. but get nothing.
Not sure if that is completely clear or not. I have been using Pfsense for a while but not really gotten too deep in rules or vlans.
-
@zachishi That is all you need. Are you sure the printer has everything configured to talk to remote subnets? Default gateway, etc?
Additionally:
You probably also want to block guests from accessing This Firewall (self).
I also like using reject rules there instead of block so the clients get an instant connection refused instead of just hanging until timeout.
-
It was a network setting on the Printer. Guess i should have started there. Blegh. Thanks for the help.
-
another wierd thing on these Vlans. Seems like if the IP is not set via dhcp then pfsense wont give it access.
-
Nothing in pfSense that will do that. Though your switch or wireless gear might have some form of DHCP snooping that does that.
-
@derelict yeah i am thinking its the managed switch not allowing the vlan traffic through. I will have to check that out.
