What's new
By:

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

YazFi Blocking internet access for certain devices on YazFi guest network

J

JoppeA

New Around Here
Hi there,
I've been using YazFi for my IOT devices in the house, and have a question. I have a guest network that has internet access, but want to add 2 devices that do not need internet access but need to be accessed by my Homekit hub on the primary WiFi network.
The first step I've been doing is to block internet access for these devices with some specific rules in /jffs/addons/YazFi.d/userscripts.d/myscript.sh
CHMOD is set to 755, and I clicked apply in YazFi settings. However the devices still seem able to access the internet. Any idea what might cause this?
The HomeKit hub is on Wi-Fi, so should it remain br0 or should I change it to eth6/eth7?

The current script I have is:
#!/bin/sh
iptables -I YazFiFORWARD -s 192.168.4.215 -o eth0 -j YazFiREJECT
iptables -I YazFiFORWARD -s 192.168.4.193 -o eth0 -j YazFiREJECT
iptables -I YazFiFORWARD -i br0 -o wl0.3 -s 192.168.50.24 -d 192.168.4.215 -j ACCEPT
iptables -I YazFiFORWARD -i br0 -o wl0.3 -s 192.168.50.24 -d 192.168.4.193 -j ACCEPT
iptables -I YazFiFORWARD -o br0 -i wl0.3 -d 192.168.50.24 -s 192.168.4.215 -j ACCEPT
iptables -I YazFiFORWARD -o br0 -i wl0.3 -d 192.168.50.24 -s 192.168.4.193 -j ACCEPT

The first lines are supposed to block WAN access, the other lines are there to allow access from the HomeKit hub to the devices, but this also does not seem to work unfortunately, as I cannot access the devices within the Home app.

The YazFi network is setup to allow internet access in general, client isolation is on, and 1/2way to guest is disabled. I only want these specific two devices to not be able to access the internet but able to be accessed from my home WiFi.

Thanks
 
JoppeA said:
The first lines are supposed to block WAN access, the other lines are there to allow access from the HomeKit hub to the devices, but this also does not seem to work unfortunately, as I cannot access the devices within the Home app.
Click to expand...
See the following post, if you haven't already, in another thread which may have some suggestions:
https://www.snbforums.com/threads/allowing-access-to-selected-network-devices.80405/#post-784521
To allow a single main LAN client to access to all YazFi Guests you may need to do something like this (adjusting for your setup).
Code: 
#!/bin/sh
iptables -I YazFiFORWARD -i wl0.1 -o br0 -d 192.168.1.100 -j ACCEPT
iptables -I YazFiFORWARD -i br0 -o wl0.1 -s 192.168.1.100 -j ACCEPT
Or to allow a specific main LAN client to access a specific YazFi Guest(s).
Code: 
#!/bin/sh
iptables -I YazFiFORWARD -i wl0.1 -o br0 -s 192.168.3.50 -d 192.168.1.100 -j ACCEPT
iptables -I YazFiFORWARD -i br0 -o wl0.1 -s 192.168.1.100 -d 192.168.3.50 -j ACCEPT
Make sure to check the entries carefully to ensure the correct punctuation and IP addresses are used. You may need to use reserved/static IP addresses for your YazFi Clients as well. Example here:
https://www.snbforums.com/threads/y...inc-ssid-vpn-client.45924/page-32#post-473403
And here:
https://github.com/jackyaz/YazFi/wi...e-and-ARP-records#a-note-on-dhcp-reservations
 
Last edited:
Hi, thanks for your message. I indeed found those links and your earlier posts and tried to replicate the posted scripts (as shown in the startpost), but for some reason I still cannot connect to the devices and they keep internet access, despite my changes. So what could I have done wrong? When comparing your lines with the one I use, it seems to be an exact copy, except for the exact IP addresses.
 
JoppeA said:
When comparing your lines with the one I use, it seems to be an exact copy, except for the exact IP addresses.
Click to expand...
Your code looks somewhat different than the examples in my post. Maybe try the following to allow traffic between the main LAN IP address 192.168.50.24 and the two YazFi 2.4Ghz Guest #3 IP addresses 192.168.4.215 and 192.168.4.193:
Code: 
iptables -I YazFiFORWARD -i wl0.3 -o br0 -s 192.168.4.215 -d 192.168.50.24 -j ACCEPT
iptables -I YazFiFORWARD -i br0 -o wl0.3 -s 192.168.50.24 -d 192.168.4.215 -j ACCEPT
iptables -I YazFiFORWARD -i wl0.3 -o br0 -s 192.168.4.193 -d 192.168.50.24 -j ACCEPT
iptables -I YazFiFORWARD -i br0 -o wl0.3 -s 192.168.50.24 -d 192.168.4.193 -j ACCEPT
 
Hi,

I was looking on this forum for a solution to my issue and stumbled on this thread.

I've set up 2 guest network with YazFi (Guest 2 and 3). Guest 2 is for my IoT devices and for this network I set to Yes the Client Isolation option and to No the One way to guest, the Two way to guest and the Allow Internet access options.

1690638993224.png


I've also given static IP addresses to the devices on the IoT network by following the procedure described in this @bennor 's post.
and now my /jffs/scripts/dnsmasq.postconf file looks like this:

Bash: 
#!/bin/sh
CONFIG=$1
source /usr/sbin/helper.sh
pc_append "dhcp-host=84:CC:A8:B0:AD:9C,192.168.101.21,LivingRollerShutter" $CONFIG
pc_append "dhcp-host=A8:03:2A:1E:66:B0,192.168.101.42,Boiler" $CONFIG

Now, I want to modify the above set by allowing:
1) a 2 way communication only between the Raspberry Pi on the main network and all the devices on the IoT network
2) internet access only to some of the devices on the IoT network.

To accomplish the first step I followed the procedure in bennor's post I mentioned above and my file /jffs/addons/YazFi.d/userscripts.d/myscript.sh looks like this

Bash: 
#!/bin/sh
iptables -I YazFiFORWARD -i wl0.2 -o br0 -d 192.168.50.2 -j ACCEPT
iptables -I YazFiFORWARD -i br0 -o wl0.2 -s 192.168.50.2 -j ACCEPT

However, when I try to ping any of the devices on the IoT network from the Raspberry Pi I get the below messages:

Bash: 
ping 192.168.101.21
PING 192.168.101.21 (192.168.101.21) 56(84) bytes of data.
From 192.168.50.1 icmp_seq=1 Destination Port Unreachable
From 192.168.50.1 icmp_seq=2 Destination Port Unreachable
From 192.168.50.1 icmp_seq=3 Destination Port Unreachable
From 192.168.50.1 icmp_seq=4 Destination Port Unreachable

--- 192.168.101.21 ping statistics ---
4 packets transmitted, 0 received, +4 errors, 100% packet loss, time 3062ms

What am I missing?

Thanks in advance for any help
 
Last edited:
What is the IP address of the Raspberry PI? Make sure that IP address is the same as the one use in the iptables code. (post edit after reread)

As a troubleshooting step, reboot the router if you haven't already done so as a troubleshooting step.
 
Last edited:
bennor said:
What is the IP address of the Raspberry PI? Make sure that IP address is the same as the one use in the iptables code. (post edit after reread)

As a troubleshooting step, reboot the router if you haven't already done so as a troubleshooting step.
Click to expand...
Hi, the IP of the Raspberry Pi is 192.168.50.2. I have already tried to reboot the router after applying the YazFi settings.
 
Narios said:
Hi, the IP of the Raspberry Pi is 192.168.50.2. I have already tried to reboot the router after applying the YazFi settings.
Click to expand...
What device is using IP address 192.168.50.1 (per your ping example)? On my Pi, on the main LAN, when it fails to ping a client on YazFi it returns the ip address of the Raspberry Pi. Example:
From 192.168.2.150 icmp_seq=1 Destination Host Unreachable
 
@Narios a few other suggestions. Make sure you have followed the directions for creating the myscripts file which includes making it executable: chmod +x /jffs/addons/YazFi.d/userscripts.d/myscript.sh. One can use the YazFi CLI to force YazFi to reload by selecting Option 1. Just did a quick test on a RT-AX86U Pro and can ping from my Raspberry Pi (192.168.2.150) to YazFi Guest Wifi 2 (2.4 Ghz) client at IP address 192.168.3.91.
Code: 
#!/bin/sh
iptables -I YazFiFORWARD -i wl0.2 -o br0 -d 192.168.2.150 -j ACCEPT
iptables -I YazFiFORWARD -i br0 -o wl0.2 -s 192.168.2.150 -j ACCEPT

Code: 
admin@Pi:~ $ ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.2.150  netmask 255.255.255.0  broadcast 192.168.2.255
        inet6 xxxx::xxxx:xxxx:xxxx:xxxx  prefixlen 64  scopeid 0x20<link>
        ether xx:xx:xx:xx:xx:xx  txqueuelen 1000  (Ethernet)
        RX packets 1054831  bytes 130299796 (124.2 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 399515  bytes 43419155 (41.4 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 144578  bytes 16244508 (15.4 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 144578  bytes 16244508 (15.4 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

admin@Pi:~ $ ping 192.168.3.91
PING 192.168.3.91 (192.168.3.91) 56(84) bytes of data.
64 bytes from 192.168.3.91: icmp_seq=1 ttl=63 time=137 ms
64 bytes from 192.168.3.91: icmp_seq=2 ttl=63 time=373 ms
64 bytes from 192.168.3.91: icmp_seq=3 ttl=63 time=138 ms
64 bytes from 192.168.3.91: icmp_seq=4 ttl=63 time=102 ms
64 bytes from 192.168.3.91: icmp_seq=5 ttl=63 time=122 ms
^Z
[7]+  Stopped                 ping 192.168.3.91
admin@Pi:~ $
(Post edited to provide additional information)
 
Last edited:
Hi, followed the instructions step by step and tried to apply the YazFi changes both via the CLI and the WebGUI.

To reply also to your previous post, the device with IP 192.168.50.1 is the router (an RT-AX56U) and the Raspberry Pi with IP 192.168.50.2 is connected to the router via the LAN1 port. In my example, I was connected via SSH to the Raspberry Pi from a laptop on to the main and I was trying to ping the device 192.168.101.21 on the Guest 2 network
 
Narios said:
I was trying to ping the device 192.168.101.21 on the Guest 2 network
Click to expand...
Just remembered that using the IP address subnets 192.168.101.x and 192.168.102.x may cause issues because Asus firmware uses those for certain firmware Guest WiFi features. A quick forum search for those IP addresses confirms it. Change the YazFi IP address subnet range to something else and adjust the myscript.sh to match. In my example, which works, I'm using different YazFi IP address subnets than 192.168.101.x and 102.x.
 
bennor said:
Just remembered that using the IP address subnets 192.168.101.x and 192.168.102.x may cause issues because Asus firmware uses those for certain firmware Guest WiFi features. A quick forum search for those IP addresses confirms it. Change the YazFi IP address subnet range to something else and adjust the myscript.sh to match. In my example, which works, I'm using different YazFi IP address subnets than 192.168.101.x and 102.x.
Click to expand...
I changed the YazFi subnets but that didn't work.

I have also tried to add another rule to allow the internet access for the device with IP 192.168.126.42 and now the /jffs/addons/YazFi.d/userscripts.d/myscript.sh file looks like this
Bash: 
#!/bin/sh
iptables -I YazFiFORWARD -i wl0.2 -o br0 -d 192.168.50.2 -j ACCEPT
iptables -I YazFiFORWARD -i br0 -o wl0.2 -s 192.168.50.2 -j ACCEPT
iptables -I YazFiFORWARD -s 192.168.126.42 -o eth0 -j ACCEPT

That device, however, has still no access to the internet. I made the file executable with
Bash: 
chmod +x /jffs/addons/YazFi.d/userscripts.d/myscript.sh
, applied the YazFi changes and even rebooted and then turned off and on the router...still no luck. I managed to assigne static IPs to the devices on the IoT network through the /jffs/scripts/dnsmasq.postconf file:

Bash: 
#!/bin/sh
CONFIG=$1
source /usr/sbin/helper.sh
pc_append "dhcp-host=84:CC:A8:B0:AD:9C,192.168.126.21,LivingRollerShutter" $CONFIG
pc_append "dhcp-host=A8:03:2A:1E:66:B0,192.168.126.42,Boiler" $CONFIG
cat /jffs/addons/YazFi.d/.dnsmasq >> /etc/dnsmasq.conf # YazFi

By the way, if I set to Yes the One way to guest or the Two way to guest, then I can ping the devices on Guest 2 from the Raspberry (and from other devices on the main network as well).

Edit: I have added the 2 rules below to test if the Raspberry Pi was the issue and now I can ping devices on Guest 2 network from another laptop (with IP 192.168.50.231) which is connected to the main network via WiFi (not via ethernet as the Raspberry Pi)
Bash: 
iptables -I YazFiFORWARD -i wl0.2 -o br0 -d 192.168.50.231 -j ACCEPT
iptables -I YazFiFORWARD -i br0 -o wl0.2 -s 192.168.50.231 -j ACCEPT
 
Last edited:
Narios said:
Edit: I have added the 2 rules below to test if the Raspberry Pi was the issue and now I can ping devices on Guest 2 network from another laptop (with IP 192.168.50.231) which is connected to the main network via WiFi (not via ethernet as the Raspberry Pi)
Click to expand...
How is the Raspberry Pi configured? Is it a headless setup or the desktop OS? Is it configured to run a specific service or program? How is it connected to the local network? Directly to the router's LAN port or through a extender, AiMesh, or some other method?

In my case my Raspberry Pi is headless running Raspberry Pi OS Lite along with Pi-Hole and Unbound directly connected to the router's LAN port, and as previously indicated it could ping a YazFi Guest 2 client with the settings in my prior post.
 
bennor said:
How is the Raspberry Pi configured? Is it a headless setup or the desktop OS? Is it configured to run a specific service or program? How is it connected to the local network? Directly to the router's LAN port or through a extender, AiMesh, or some other method?

In my case my Raspberry Pi is headless running Raspberry Pi OS Lite along with Pi-Hole and Unbound directly connected to the router's LAN port, and as previously indicated it could ping a YazFi Guest 2 client with the settings in my prior post.
Click to expand...
Hi, thanks a lot for your time and patience.

The Raspberry is headless and it is connected to the router's LAN port, running Raspberry Pi OS (Debian bullseye) along with Home Assistant a d other services (duckdns, caddy, mosquitto and esphome) in Docker.

Prior to buying the Asus router I installed hostapd on the Raspberry Pi so that it was acting as a router of its own local network, blocking internet access to the devices connected to this network. I've reverted all the changes made to create such a network, but I am not sure if I've forgot something or broken something in the process.
 
Narios said:
Prior to buying the Asus router I installed hostapd on the Raspberry Pi so that it was acting as a router of its own local network, blocking internet access to the devices connected to this network. I've reverted all the changes made to create such a network, but I am not sure if I've forgot something or broken something in the process.
Click to expand...
Sounds like something might have gotten left over or is interfering if you didn't wipe the Pi OS boot device and start from scratch. As a troubleshooting step setup another Pi OS boot device, if you have one available, from scratch with the Pi OS without all the extra services and see if the issue happens.
 
bennor said:
Sounds like something might have gotten left over or is interfering if you didn't wipe the Pi OS boot device and start from scratch. As a troubleshooting step setup another Pi OS boot device, if you have one available, from scratch with the Pi OS without all the extra services and see if the issue happens.
Click to expand...
Hi, sorry for getting back just now but I found out the issue: I was reserving a static IP for the Raspberry Pi through the dhcp.conf file rather than at router level. Once I removed the IP reservation at Raspberry level, then everything worked as expected. I hope this can help anybody with the same issue.

Also, @bennor thanks a lot for your help.

Cheers
 
You must log in or register to reply here.

Similar threads

D
YazFi Allowing cast traffic from guest network to IoT (media) network
Replies
11
Views
552
bennor
B
W
YazFi Can YazFi custom firewall rules overcome VLAN client isolation?
Replies
3
Views
353
bennor
B
J
YazFi Can't make Yazfi working with Wireguard
Replies
13
Views
805
Jacky0611
J
B
YazFi Help with IPTables Script
Replies
2
Views
1K
binky
B
P
Allowing main network to access guest networks
Replies
4
Views
539
bennor
B
Similar threads
Thread starter Title Forum Replies Date
B Skynet Skynet blocking Call of Duty (Warzone 3) Asuswrt-Merlin AddOns 10
Zakalwe Diversion(?) blocking 4OD (well I mean it detects the adblocker and won't work) Asuswrt-Merlin AddOns 3
kstamand Diversion [SOLVED] Exclude subnet from Diversion blocking Asuswrt-Merlin AddOns 4
N Skynet SkyNet/Firewall blocking all ping requests, including outbound Asuswrt-Merlin AddOns 6
Y Diversion Diversion Not Blocking Ads Asuswrt-Merlin AddOns 9
Jack-Sparr0w Unbound Redirect Internet traffic through tunnel best setting for unbound dns and vpn Asuswrt-Merlin AddOns 3
D CakeQOS GT-AX11000 with 1.5gbit symmetrical fibre internet and QoS Asuswrt-Merlin AddOns 31
P Skynet Internet speed lower with Skynet on Asuswrt-Merlin AddOns 9
R No internet connection for amtm after pi-hole installation Asuswrt-Merlin AddOns 12
G Wireguard Wireguard: No access to LAN on Windows 11 Client Asuswrt-Merlin AddOns 0

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 957 (members: 34, guests: 923)
Back
Top