I only have Pro devices for now, so also agree with Seth's question on whether this is kept in sync with what is already there. Meaning if I add this, will it pull in existing VLAN configurations?
I do fully think this could become an incredibly powerful add-in if you consider adding some firewall-start logic and sh refresh or restart to apply IPTable configurations. I have found this could be accomplished fairly programmatic (even though I am not a programmer/coder). Sharing my current config as reference, which includes a cleanup to prevent duplication when applying without firewall restart. Using Avahai reflector, which is also included as mDNS portion for reference, which supports casting to smart devices accessible cross-VLAN.
Code:
#!/bin/sh
# ===== Variables =====
PRINTER_IP="192.168.52.20"
VALERION_IP="192.168.52.254"
LAN_NET="192.168.50.0/24"
GUEST_NET="192.168.55.0/24"
SOMVE_NET="192.168.56.0/24"
# ===== Cleanup old printer rules =====
# This removes any existing rules that reference the printer IP
iptables -S FORWARD | grep "$PRINTER_IP" | while read -r rule; do
# Convert the -A rule line into -D so it deletes cleanly
iptables -D FORWARD ${rule#-A FORWARD }
done
# ===== Allow LAN + Guests to reach printer =====
# Insert at the top so they^rre evaluated before logdrop
for NET in "$LAN_NET" "$GUEST_NET" "$SOMVE_NET"; do
iptables -I FORWARD 1 -s "$NET" -d "$PRINTER_IP" -j ACCEPT
done
# ===== Cleanup old Valerion rules =====
iptables -S FORWARD | grep "$VALERION_IP" | while read -r rule; do
iptables -D FORWARD ${rule#-A FORWARD }
done
# ===== Allow LAN to reach Valerion =====
iptables -I FORWARD 1 -s "$LAN_NET" -d "$VALERION_IP" -j ACCEPT
# ===== Cleanup all existing mDNS rules =====
for CHAIN in INPUT FORWARD; do
while iptables -L $CHAIN --line-numbers -n | grep "udp dpt:5353" >/dev/null; do
LINENO=$(iptables -L $CHAIN --line-numbers -n | grep "udp dpt:5353" | head -n1 | awk '{print $1}')
iptables -D $CHAIN $LINENO
done
done
# ===== Re-add reflection rules =====
iptables -A INPUT -i br0 -p udp --dport 5353 -j ACCEPT
iptables -A INPUT -i br54 -p udp --dport 5353 -j ACCEPT
iptables -A FORWARD -i br0 -o br54 -p udp --dport 5353 -j ACCEPT
iptables -A FORWARD -i br54 -o br0 -p udp --dport 5353 -j ACCEPT
