ping device in Guest wifi with "Access Intranet" disabled

[przemekwawa]

Hi,
I need to disable access to intranet for guest devices, but for one of them I need to have ability to ping it from LAN.
I tried:
ebtables -t filter -I FORWARD -p IPv4 -d GUEST_DEVICE_MAC --ip-proto icmp -j ACCEPT
ebtables -t filter -I FORWARD -p IPv4 -s GUEST_DEVICE_MAC --ip-proto icmp -j ACCEPT

but it does not work, I still can't ping it from LAN... could you help/direct me?

 

[przemekwawa]

I tried also Yazfi version of guest wifi, but does not suit my situation - I need to have assigned using DHCP specific IP adresses for devices in "Guest" wifi.

 

[CaptainSTX]

Go into network tools on the router and run the PING from there. Pinged devices will respond to the router even if they are on the Guest network with access to Intranet blocked.

 

[przemekwawa]

Go into network tools on the router and run the PING from there. Pinged devices will respond to the router even if they are on the Guest network with access to Intranet blocked.

I know that, it works. But i need to Ping from specific LAN device to specific guest device and get proper response. Opposit is not needed btw.

 

[przemekwawa]

I need to disable access to intranet for guest devices, but for one of them I need to have ability to ping it from LAN (from specific LAN device to specific guest device).
I tried without success (no counters are changing):
ebtables -t filter -I FORWARD -p IPv4 -d GUEST_DEVICE_MAC --ip-proto icmp -j ACCEPT
ebtables -t filter -I FORWARD -p IPv4 -s GUEST_DEVICE_MAC --ip-proto icmp -j ACCEPT

So I checked
-p ARP -o wl0.1 -j ACCEPT
-p ARP -i wl0.1 -j ACCEPT

and it works. But then devices from guest can ping and even connect to LAN, so it makes no sense.

Any ideas how to achieve that? I tried also YazFi solution, but there is no possibility to assign static dhcp for guest users.

 

[Jack Yaz]

I created similar post on another subforum, but I get no answer, so maybe someone here would be helpfull.

I need to disable access to intranet for guest devices, but for one of them I need to have ability to ping it from LAN (from specific LAN device to specific guest device).
I tried without success (no counters are changing):
ebtables -t filter -I FORWARD -p IPv4 -d GUEST_DEVICE_MAC --ip-proto icmp -j ACCEPT
ebtables -t filter -I FORWARD -p IPv4 -s GUEST_DEVICE_MAC --ip-proto icmp -j ACCEPT

So I checked
-p ARP -o wl0.1 -j ACCEPT
-p ARP -i wl0.1 -j ACCEPT

and it works. But then devices from guest can ping and even connect to LAN, so it makes no sense.

Any ideas how to achieve that? I tried also YazFi solution, but there is no possibility to assign static dhcp for guest users.

You can use YazFi to handle the firewall and heavy lifting, then edit dnsmasq.conf.add to assign IPs for your guest devices

 

[przemekwawa]

You can use YazFi to handle the firewall and heavy lifting, then edit dnsmasq.conf.add to assign IPs for your guest devices

Awesome idea thank you!