2

I would like to know how to block routing between subnets on my Ubiquiti EdgeRouter. These subnets are on 6 different VLANs, and the layout goes like this:

VLAN 1 - 10.0.0.1/24 (management)

VLAN 100 - 10.1.1.1/24

VLAN 200 - 10.2.1.1/24

VLAN 300 - 10.3.1.1/24 (guest network)

VLAN 400 - 10.4.1.1/24

VLAN 450 - 10.4.2.1/24 (guest network)

I want VLAN 1 to have access into all the other networks, since it is the management network, and access to it is heavily secured, but I do not want any of the other networks to be able to talk to each other at all.

I would also like to allow a group of admin computers access to any subnet either from VLAN 200's subnet, or ideally, from any subnet (based on MAC address I suppose..)

I feel like this should be fairly simple to implement via some form of ACLs or Firewall rules, but I do not have a strong enough grasp of these concepts to implement this at this point in time.

Thanks in advance for your help!

Improve this question
3
  • As you guessed, you would do this with the firewall features of the device. Do you have specific questions about the process? Can you provide the configuration you have and what doesn't seem to be working about it? As it stands, it sounds like you are asking us to configure your device for you, which is not what this community is here to provide.
    – YLearn
    Commented Jun 5, 2015 at 23:52
  • Thanks for the response. While I would love a specific configuration for the device, I understand that is way out of the scope of this forum. Essentially, my question is: "what method/concept is used to block access between these different networks." So far my configuration is essentially default, there is nothing blocking (partially or completely) between these subnets, but they are wide open. What I would like, is a sort of "best practice" for locking these different networks down. Thanks for your help!
    – Chris Cummings
    Commented Jun 6, 2015 at 8:52
  • Perhaps a more specific question would be: "What is the difference between in/out/local firewall rules, and what is the difference between firewall rules and ACLs. (And are ACLs possible on the EdgeRouter..)
    – Chris Cummings
    Commented Jun 6, 2015 at 8:55

1 Answer 1

Reset to default
2

Chapter 5 of the manual here should get you started.

What you want to do is:

  • Allow traffic from your admin computers to anywhere in 10.0.0.0/8

  • Deny all traffic from 10.0.0.0/8 to 10.0.0.0/8

  • Permit all traffic to 0.0.0.0/0 (assuming those other vlans are allowed to reach the Internet).

Rules are processed in order and the first rule they hit will be the effective one so your management computers will "hit" the first rule and be allowed. Other computers trying to reach other vlans will "hit" the second rule. Traffic that is not destined to other vlans (source and destination not both within 10.0.0.0/8) will be allowed (internet traffic).

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.