<![CDATA[Help with fw rules, vlan and LG TV (Miracast)]]>Hello,
I'm still new at this and maybe I'm trying to do something that is not possible. But I hope the collective can help. I also did a lot of searching, but I have not been able to find the answer to my situation. So here goes:

TL;DR
I need help adjusting my FW rule to allow screensharing from Office VLAN to IoT VLAN. The devices can see each other, but my IoT FW rule (that prevents VLAN to VLAN communication) blocks the screensharing to complete. So what FW rule should I implement to allow screensharing sessions, but still block other VLAN to VLAN traffic?

The setup

  • Pfsense 2.4.5-RELEASE-p1
  • Avahi 2.1_1
  • Office VLAN (10.10.20.xx)
  • IoT VLAN (10.10.40.xx)
  • LG TV (Miracast) on IoT VLAN (10.10.40.50)

The Use Case

  • Cast/Screenshare from Office VLAN to LG TV on IoT VLAN

Current status
I can discover the LG TV on my Office VLAN (Avahi is working). When I establish a screensharing session I can see in pfTop a connection "ESTABLISHED: ESTABLISHED" between my laptop (10.10.20.54) and the LG TV (10.10.40.50)

But, the screensharing is blocked by my FW rule, that blocks access to Office and other VLANs.

Firewall Rules
These rules are in place to prevent traffic to flow between VLANS. Maybe there is a better way. FYI. my WAN address is part of RFC1918 range.

Screenshot 2020-11-02 at 12.34.00.png

Screenshot 2020-11-02 at 12.35.19.png

pfTop
As you can see, then there is an established connection form my laptop (10.10.20.54) to the LG TV (10.10.40.50)
Screenshot 2020-11-02 at 12.36.20.png

Firewall Log
And unfortunately then the session is blocked by my FW rule. If I disable this rule, then it works. But I thought that if the connection is initiated by 10.10.20.54 (Office) then 10.10.40.50 (IoT) would be allowed to respond on any port.
Screenshot 2020-11-02 at 12.37.22.png

]]>https://forum.netgate.com/topic/158064/help-with-fw-rules-vlan-and-lg-tv-miracastRSS for NodeFri, 16 Oct 2026 18:02:28 GMTMon, 02 Nov 2020 10:45:59 GMT60<![CDATA[Reply to Help with fw rules, vlan and LG TV (Miracast) on Wed, 09 Jun 2021 13:06:52 GMT]]>@logboss Not in a ideal way with specific miracast ports. I simply assigned the TV a static IP and added Allow rule from TV to Office Net and from the Office Net to the TV. So not they can communicate on all ports to TV IP.

Not great, but it works :-)

IOT Net Rule
Screenshot 2021-06-09 at 16.05.16.png

Office Net Rule
Screenshot 2021-06-09 at 16.05.08.png

]]>https://forum.netgate.com/post/986933https://forum.netgate.com/post/986933Wed, 09 Jun 2021 13:06:52 GMT<![CDATA[Reply to Help with fw rules, vlan and LG TV (Miracast) on Wed, 09 Jun 2021 02:43:07 GMT]]>@lipsum said in Help with fw rules, vlan and LG TV (Miracast):

@tehwolf
I'll test this, but as far as I remember, the the destination port that the TV is sending on is random (in this case 52499). I would assume that mira cast would have a range that I can define.

I'll also take a look at the source port (35553) to see if that is static.

Thanks for the input and explanation.

Did you ever get this working? Can you please share your setup?

]]>https://forum.netgate.com/post/986867https://forum.netgate.com/post/986867Wed, 09 Jun 2021 02:43:07 GMT<![CDATA[Reply to Help with fw rules, vlan and LG TV (Miracast) on Tue, 03 Nov 2020 15:50:32 GMT]]>@tehwolf
I'll test this, but as far as I remember, the the destination port that the TV is sending on is random (in this case 52499). I would assume that mira cast would have a range that I can define.

I'll also take a look at the source port (35553) to see if that is static.

Thanks for the input and explanation.

]]>https://forum.netgate.com/post/943664https://forum.netgate.com/post/943664Tue, 03 Nov 2020 15:50:32 GMT<![CDATA[Reply to Help with fw rules, vlan and LG TV (Miracast) on Tue, 03 Nov 2020 11:49:42 GMT]]>As it's UDP, there's no concept of a "session" - the TV is sending packets to the office LAN that are correctly being blocked based upon your rules

You could add an exception above the Block Office Access rule with:

protocol
IPV4 UDP

source
IOT net

port
*

destination
OFFICE net

port
52499

which would allow the traffic.. but it's not "return" traffic as far as the firewall is concerned, so it's blocking based on your current ruleset.

(you could make this more specific, if it's only the TV you want to allow - make the source the TVs IP address, and if the source port is always 35553 then add that too... if there are multiple TVs, you could create an alias for them and add them all in to that alias and use the alias as the source...)

]]>https://forum.netgate.com/post/943607https://forum.netgate.com/post/943607Tue, 03 Nov 2020 11:49:42 GMT