OK. Since the original post I made a couple of changes . I moved the denon to vlan 1 and made a rule 'block-to-wan' with my tablets ip . This is identical to the rule 'denon-to-wan' . I verified that my tablet can no longer reach the www. I also removed the mac's from the rules and verified the denon has a static ip . Here is the latest tcpdump snippet
{
"kernel": "5.15.134",
"hostname": "shadow",
"system": "MediaTek MT7621 ver:1 eco:3",
"model": "Ubiquiti EdgeRouter X",
"board_name": "ubnt,edgerouter-x",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "23.05.0",
"revision": "r23497-6637af95aa",
"target": "ramips/mt7621",
"description": "OpenWrt 23.05.0 r23497-6637af95aa"
}
}
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd97:0191:ac00::/48'
option packet_steering '1'
config device
option name 'br-lan'
option type 'bridge'
option acceptlocal '1'
list ports 'eth1'
list ports 'eth2'
list ports 'eth3'
list ports 'eth4'
config interface 'lan'
option device 'br-lan.1'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
option ipaddr '10.10.10.1'
config interface 'wan'
option device 'eth0'
option proto 'dhcp'
option peerdns '0'
list dns '1.1.1.1'
list dns '1.0.0.1'
option hostname 'DTES'
config interface 'wan6'
option device 'eth0'
option proto 'none'
config device
option name 'eth1'
option acceptlocal '1'
config device
option name 'eth2'
option acceptlocal '1'
config device
option name 'eth3'
option acceptlocal '1'
config device
option name 'eth4'
option acceptlocal '1'
config route
option interface 'lan'
option gateway '10.10.10.109'
option target '192.168.1.0/24'
config bridge-vlan
option device 'br-lan'
option vlan '1'
list ports 'eth1:u*'
list ports 'eth2:t'
list ports 'eth3:t'
list ports 'eth4:t'
config bridge-vlan
option device 'br-lan'
option vlan '3'
list ports 'eth1:t'
list ports 'eth2:t'
list ports 'eth3:t'
list ports 'eth4:t'
config interface 'lan3'
option proto 'static'
option device 'br-lan.3'
option ipaddr '10.10.20.1'
option netmask '255.255.255.0'
option ip6ifaceid '::1'
option ip6assign '64'
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '0'
option expandhosts '1'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option localservice '1'
option ednspacket_max '1232'
option local '/evinrude.net/'
option domain 'evinrude.net'
option filterwin2k '1'
option cachesize '10000'
option min_cache_ttl '3600'
option nonegcache '1'
option quietdhcp '1'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
list dhcp_option '42,10.10.10.1'
option ra 'server'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '3'
config host
option mac 'C4:2C:03:22:5F:21'
option name 'maclaptop'
option dns '1'
option ip '10.10.10.114'
config host
option mac '00:05:CD:DA:92:56'
option dns '1'
option ip '10.10.10.26'
option name 'denonav'
config host
option name 'linux-laptop'
option dns '1'
option mac 'A0:D3:7A:8D:BC:6A'
option ip '10.10.10.108'
config domain
option name 'shadow'
option ip '10.10.10.1'
config domain
option ip '10.10.10.4'
option name 'ollie'
config domain
option name 'timeserver'
option ip '10.10.10.1'
config domain
option ip '10.10.10.8'
option name 'kitten'
config dhcp 'lan3'
option interface 'lan3'
option start '10'
option limit '30'
option leasetime '12h'
list dhcp_option '42,10.10.20.1'
option ra 'server'
config host
option name 'hs200studiooutside'
option dns '1'
option mac '6C:5A:B0:EE:9B:F1'
option ip '10.10.20.38'
config host
option name 'hs200shopoutside'
option dns '1'
option mac '6C:5A:B0:EE:BA:91'
option ip '10.10.20.21'
config domain
option name 'tiberius'
option ip '10.10.10.7'
config host
option name 'brotherprinter'
option dns '1'
option mac '60:6D:C7:69:40:EB'
option ip '10.10.20.27'
config host
option name 'beelink'
option dns '1'
option mac 'E0:2E:0B:91:E9:07'
option ip '10.10.10.109'
config host
option name 'ccALivingroom'
option dns '1'
option ip '10.10.20.35'
option mac '54:60:09:FD:A4:80'
config domain
option name 'tootie'
option ip '10.10.10.3'
config domain
option name 'elog6'
option ip 'fd97:191:ac00::1010:1003'
config domain
option name 'mediaserver'
option ip '10.10.10.3'
config domain
option name 'gallery'
option ip '10.10.10.3'
config host
option name 'ccAShop'
option dns '1'
option mac '54:60:09:EA:34:DA'
option ip '10.10.20.22'
config host
option name 'ccLivingroom'
option dns '1'
option mac 'E4:F0:42:A1:D2:36'
option ip '10.10.20.11'
config domain
option name 'tootie'
option ip '10.10.20.3'
config host
option name 'HDHR-10913E38'
option dns '1'
option mac '00:18:DD:09:13:E3'
option ip '10.10.20.12'
config domain
option name 'beelink-6'
option ip 'fd97:191:ac00:0:625b:b8b9:97bc:7105'
config domain
option name 'shares'
option ip '10.10.10.3'
config domain
option name 'nfs'
option ip 'fd97:191:ac00::1010:1003'
config domain
option name 'webdav'
option ip '10.10.10.3'
config domain
option name 'elog4'
option ip '10.10.10.3'
config domain
option name 'gallery4'
option ip '10.10.10.3'
config domain
option name 'gallery6'
option ip 'fd97:191:ac00::1010:1003'
config domain
option name 'webdav6'
option ip 'fd97:191:ac00::1010:1003'
config domain
option name 'webdav4'
option ip '10.10.10.3'
config domain
option name 'time.apple.com'
option ip '10.10.10.1'
config domain
option name 'time.google.com'
option ip '10.10.10.1'
config domain
option name 'time1.google.com'
option ip '10.10.10.1'
config domain
option name 'time2.google.com'
option ip '10.10.10.1'
config domain
option name 'time3.google.com'
option ip '10.10.10.1'
config domain
option name 'time4.google.com'
option ip '10.10.10.1'
config domain
option name 'time1.apple.com'
option ip '10.10.10.1'
config domain
option name 'time2.apple.com'
option ip '10.10.10.1'
config domain
option name 'time3.apple.com'
option ip '10.10.10.1'
config domain
option name 'time4.apple.com'
option ip '10.10.10.1'
config domain
option name 'time5.apple.com'
option ip '10.10.10.1'
config domain
option name 'time6.apple.com'
option ip '10.10.10.1'
config domain
option name 'time7.apple.com'
option ip '10.10.10.1'
config domain
option name 'biscuit'
option ip '10.10.20.12'
config host
option name 'buster'
option dns '1'
option ip '10.10.10.221'
option mac '80:4E:70:0A:51:60'
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'DROP'
option synflood_protect '1'
option flow_offloading '1'
option flow_offloading_hw '1'
option drop_invalid '1'
config zone
option name 'vlan1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
config forwarding
option src 'vlan1'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping-Wan'
option family 'ipv4'
list proto 'icmp'
list icmp_type 'echo-request'
option src 'wan'
option target 'ACCEPT'
option enabled '0'
config rule
option name '3-to-dns-dhcp'
option src 'vlan3'
option dest_port '53 67'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'denon-to-wan'
option src 'vlan1'
option dest 'wan'
option target 'REJECT'
list src_ip '10.10.10.26'
option family 'ipv4'
config rule
option name 'block-to-wan'
option src 'vlan1'
option dest 'wan'
option target 'REJECT'
option family 'ipv4'
list src_ip '10.10.10.221'
config rule
option name 'Allow mdns'
option src_port '5353'
option dest_port '5353'
option target 'ACCEPT'
option device 'br-lan'
option direction 'in'
option src '*'
list proto 'udp'
list dest_ip '224.0.0.251'
list dest_ip 'ff02::fb'
config zone
option name 'vlan3'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan3'
config forwarding
option src 'vlan3'
option dest 'wan'
config rule
option name 'hdhr-to-1'
option src 'vlan3'
option target 'ACCEPT'
list proto 'tcp'
list proto 'udp'
list src_ip '10.10.20.12'
option family 'ipv4'
option src_port '1900'
option dest 'vlan1'
config rule
option name 'cc-to-vlan1'
option src 'vlan3'
option dest 'vlan1'
option target 'ACCEPT'
list proto 'tcp'
option dest_port '32768-61000'
option family 'ipv4'
option ipset 'ChromeCasts'
config forwarding
option src 'vlan1'
option dest 'vlan3'
config rule
option name 'beelink-3-to-1'
option src 'vlan3'
option dest 'vlan1'
option target 'ACCEPT'
list src_ip '10.10.20.109'
option family 'ipv4'
config redirect
option target 'DNAT'
option name 'dns-redirect-vlan3'
option family 'ipv4'
option src 'vlan3'
option src_ip '!10.10.20.1'
option src_dport '53'
option dest_ip '10.10.20.1'
option dest_port '53'
option src_dip '!10.10.20.1'
option reflection '0'
list proto 'tcp'
list proto 'udp'
option dest 'vlan3'
config redirect
option target 'DNAT'
option name 'dns-redirect-vlan1'
option family 'ipv4'
option src 'vlan1'
option src_ip '!10.10.10.1'
option src_dip '!10.10.10.1'
option src_dport '53'
option dest_ip '10.10.10.1'
option dest_port '53'
option reflection '0'
list proto 'tcp'
list proto 'udp'
option dest 'vlan1'
config redirect
option target 'DNAT'
option name 'ntp-redirect-vlan1'
option src 'vlan1'
option src_ip '!10.10.10.1'
option src_dip '!10.10.10.1'
option src_dport '123'
option dest_ip '10.10.10.1'
option dest_port '123'
list proto 'udp'
option reflection '0'
option dest 'vlan1'
config redirect
option target 'DNAT'
option name 'ntp-redirect-vlan3'
option src 'vlan3'
option src_ip '!10.10.20.1'
option src_dport '123'
option dest_ip '10.10.20.1'
option dest_port '123'
option src_dip '!10.10.20.1'
list proto 'udp'
option reflection '0'
option dest 'vlan3'
config ipset
option name 'ChromeCasts'
option family 'ipv4'
list match 'ip'
list entry '10.10.20.11'
list entry '10.10.20.22'
list entry '10.10.20.35'