Rule Help Request - VLANs

Spyderturbo007

Bear with me please as I'm pretty new to VLANs and firewall rules. I was able to get things working for the most part by watching tons of videos and reading some documentation. Here is what I have setup:

LAN (mvneta1)
IoTDevices - VLAN 30 on mvneta1
GuestNetwork - VLAN 40 on mvneta1

WAPs are managed with a self hosted Unifi controller and are setup this way:

Office - Network (192.168.10.0/24) - Default
IoTDevices - Network (192.168.30.0/24) - IoTVLAN VLAN ID = 30
GuestNetwork - Network (172.16.40.0/24) - GuestVLAN VLAN ID = 40

If I'm logged into the IoTDevices wireless network I can't access anything else which is my goal. But I have an automation controller on the IoTDevices VLAN and sometimes need to login to the web interface. For some reason, if I'm connected to the Office network, I can't access the automation controller that lives on the IoTDevices VLAN.

I thought that if the traffic was initiated from the Office LAN that the response from the client on VLAN 30 was allowed, but a connection initiated from VLAN 30 or 40 would be blocked.

I'm thinking I'm missing a rule somewhere, but I'm not sure.

!Private_Networks is 192.168.10.0/24

LAN Rules

Action Protocol Source Port Destination Gateway
Allow IPV4* LAN Net * * *
Allow IPV6* LAN Net * * *

IoTDevices

Action Protocol Source Port Destination Gateway
Block IPV4* TCP This Firewall 10443 * *
Allow IPV4* * * !Private_Networks *

GuestNetwork

Action Protocol Source Port Destination Gateway
Block IPV4* TCP This Firewall 10443 * *
Allow IPV4* * * !Private_Networks *

Sorry for the long post, but I wanted to make sure I included all the information. Thank you for the help.

johnpoz

@Spyderturbo007 said in Rule Help Request - VLANs:

I thought that if the traffic was initiated from the Office LAN that the response from the client on VLAN 30 was allowed,

This is correct.. The return traffic would be allowed by the state.

Are you policy routing on the source network trying to go to your iot network? ie does your rule that allows the any any have a gateway set in the rule sending traffic to like a vpn or your wan dhcp gateway, or is the gateway on the rule set to just the default *

If your not policy routing, do you have any rules in the floating tab?

Screenshots are always easier to look..

Common issue is users always forget some host firewall on where your trying to go, just because pfsense rules allow A to talk to B, doesn't mean the firewall on B is going to allow it.

Other common problems - B is not using pfsense as its gateway.. Or the mask on B is wrong and things the traffic coming from A is on its own local network and doesn't send its answer back to pfsense.

Spyderturbo007

@johnpoz Thank you so much for the help!

I opened the any/any rule and found Gateway under the Advanced Settings. Both the any/any rule for IoT and Office are set to Default.

Floating rules are blank and say "No floating rules are currently defined..."

I think I understand your section about "Other common problems". I checked the DHCP server part of both networks and the subnet mask on both is set to 255.255.255.0. The gateway for both (under DHCP Server - Other Options) is blank.

Spyderturbo007

@johnpoz

I think I might be onto something here. I was bouncing back and forth between networks and I'm thinking it might be a DNS issue and not a routing issues. I'm connecting to the controller using it's DNS name (http://zb-000XXX00.local) which is what has been failing. But if I connect to it using 192.168.30.132 from the 192.168.10.0 network I can connect. But I can't connect to it from the 192.168.10.0 network using it's DNS name, only IP address.

johnpoz

@Spyderturbo007 said in Rule Help Request - VLANs:

(http://zb-000XXX00.local) which is what has been failing

Why would you think mdns would resolve if your not on the same network? That is a local discovery method..

If you want to use name of something, then give it a fqdn.. host.yourdomain.tld - this can be done via registering static dhcp reservations, or simple host override.

My wifi controller sits on a different network than my pc.. I am on 192.168.9.100/24 and controller is at 192.168.2.13/24

but see it resolves with a fqdn

$ ping uc.home.arpa

Pinging uc.home.arpa [192.168.2.13] with 32 bytes of data:
Reply from 192.168.2.13: bytes=32 time=2ms TTL=63
Reply from 192.168.2.13: bytes=32 time=1ms TTL=63

Pfsense now defaults to using home.arpa as the local domain, because this is the recommended domain to use locally.

https://www.rfc-editor.org/rfc/rfc8375.html
Special-Use Domain 'home.arpa.'