Yeah, I appreciate the common knowledge that was gathered around and we can discuss, speculate and entertain tinkering, so kudos to people sharing!
Moving on with my IoT plight, I'll document in this post my findings.
Notes:
- 192.168.1.1 GT-AX6000 as gateway. One RP-AX58 for AiMesh coverage for a garage camera/sensor.
- I will control devices' internet access with Parental Controls > Time Scheduling, so I don't need to do anything else to restrict them from the internet, this is granular enough for me for when I want to update something, or allow something when configuring.
- I think I also need mDNS/IPv6 traffic to work between VLANs, but first let's try to get the Printer/HomePods/HomeAssistant to talk to each other.
I've now remade the IoT network with the following Guest Network Pro settings:
- 192.168.52.0 /24 - IoT VLAN "52" for sensors, security/cameras, lights, power relays and other IoT devices that don't need an internet connection
Code:
2.4 Ghz, WPA2/3, 25 Mbit DL/UP limit, no intranet access, Hidden SSID, isolated AP, over AiMesh.
- 192.168.53.0 /24 - Guest VLAN "53", for TVs, work laptop, kids' devices, guests, basically devices that need internet connection
Code:
5 Ghz, WPA2/3, 100/100 Mbit DL/UP limit, no intranet access, Cloudflare Family DNS, isolated AP, over AiMesh.
I have these use cases:
- Home Assistant/PC on 192.168.1.x has to have access to VLAN 52 to orchestrate/control IoT.
- Printer on 192.168.1.x has to have access to VLAN 53 to print work/guest/kids' files.
- Two HomePods on 192.168.1.x have to have access to VLAN 52 to supplement HomeAssistant for notifications/control when not at home.
- DNS & NTP have to work from VLAN 52 to br0.
Let's get them talking first (
https://github.com/RMerl/asuswrt-merlin.ng/wiki/User-scripts).
Let's start with
nano jffs/scripts/firewall-start
Bash:
# 192.168.1.2 PC
# 192.168.1.3 HomeAssistant
# 192.168.1.4 HomePod1
# 192.168.1.5 HomePod2
# 192.168.1.7 Printer
#
# br0 main; br52 IoT; br53 guest
#
iptables -I FORWARD -i br52 -o br0 -p udp --dport 53 -j ACCEPT # DNS
iptables -I FORWARD -i br52 -o br0 -p udp --dport 123 -j ACCEPT # NTP
iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT # Return traffic
#
# Allow br53 to access br0 printer
iptables -I FORWARD -i br53 -o br0 -d 192.168.1.7 -j ACCEPT
# Allow response from br0 printer to br53
iptables -I FORWARD -i br0 -o br53 -s 192.168.1.7 -j ACCEPT
#
# Allow specific br0 devices access to br52 devices
iptables -I FORWARD -i br0 -o br52 -s 192.168.1.2 -d 192.168.52.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o br52 -s 192.168.1.3 -d 192.168.52.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o br52 -s 192.168.1.4 -d 192.168.52.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o br52 -s 192.168.1.5 -d 192.168.52.0/24 -j ACCEPT
# Allow return traffic from br52 devices to br0
iptables -I FORWARD -i br52 -o br0 -s 192.168.52.0/24 -d 192.168.1.2 -j ACCEPT
iptables -I FORWARD -i br52 -o br0 -s 192.168.52.0/24 -d 192.168.1.3 -j ACCEPT
iptables -I FORWARD -i br52 -o br0 -s 192.168.52.0/24 -d 192.168.1.4 -j ACCEPT
iptables -I FORWARD -i br52 -o br0 -s 192.168.52.0/24 -d 192.168.1.5 -j ACCEPT
#
# Allow mDNS traffic between br0 and br52
iptables -I INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
iptables -I FORWARD -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
iptables -I OUTPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
#
Make sure script is executable:
chmod a+rx /jffs/scripts/*
Make sure firewall is restarted:
service restart_firewall
Check if it's been added correctly with
iptables -S (top of -A FORWARD lines)
I've also created an
avahi-daemon.postconf with the following to help mDNS (you also have to
chmod a+rx /jffs/scripts/* this and
service restart_mdns):
Bash:
#!/bin/sh
CONFIG=$1
source /usr/sbin/helper.sh
pc_replace "use-ipv6=no" "use-ipv6=yes" "$CONFIG"
pc_append " " "$CONFIG"
pc_append "[reflector]" "$CONFIG"
pc_append "enable-reflector=yes" "$CONFIG"
pc_insert "deny-interfaces=eth0" "allow-interfaces=br0,br52" "$CONFIG"
Solution after restart:
- I was able to add the main printer, by IP, from a Guest device and successfully print.
- I was able to access IoT devices from PC (ping or
http://ip, but not DNS set at GNP level) and by HomeAssistant (
http://ip or MQTT access worked, with DNS or IP).
Questions & Problems:
- I was able to partially configure IoT devices on br52 to use DNS from br0 when addressing the router on it (router.lan) at least.
- Do I need iptables rules for PING/ICMP, as well as NTP/DNS between VLANs? Is there a better way to allow this "administrative" traffic?
- A device from the IoT VLAN 52 doesn't seem to be able to use 192.168.1.x:123 from br0, or router.lan for its DNS for NTP, seems to always time out... Is there like anything I can use, like 192.168.52.1 or something else for that VLAN specific NTP?
- Matter on HomeAssistant still doesn't work (Failed to advertise records: src/inet/UDPEndPointImplSockets.cpp:421: OS Error 0x02000065: Network is unreachable)...
