Hello, I recently bought a WRT3200ACM to replace my spotty AC1900 and, of course, the first thing I did was install OpenWRT on it! I've got it set up nicely, but I've run into a snag.
Firstly, let me explain my setup a little bit:
I have four wireless networks:
- Regular 2.4G
- Guest 2.4G
- Regular 5G
- Guest 5G
I've split these network (as well a two of each of the ethernet ports) into separate VLANs as I have now hooked up all my IoT devices to the guest network. I'm allowing specific one-to-one connections across the barrier such as SSH to my Raspberry Pi from my laptiop, etc.
One thing I've grown accustomed to since all of my workhorse machines run Linux is Avahi/Bonjour/mDNS. Honestly, I just love the convenience of 'ssh raspberrypi.local' rather than using the static IP (I know, it's silly). However, other devices on my guest VLAN, such as my Google Home Mini also use mDNS in some form or fashion. I've managed to get mDNS working between VLANS using the reflector mode of avahi-daemon, however, I would like to filter mDNS responses from my LAN zone to my guest zone. If I can accomplish this, then I can still utilize the mDNS functionality of the devices on the guest network without exposing any information about computers on my LAN zone to the guest zone.
Reflecting only on my br-guest interface allows my LAN computers to see the mDNS-enabled computers on the guest network, however something like 'ssh raspberrypi.local' does not allow a connection to the advertised device due to the fact that the mDNS request is not reflected from br-lan to br-guest.
At this point I think I need some kind of deep packet inspection so that I can filter mDNS replys only from the LAN zone to the guest zone, while allowing mDNS requests to pass through unhindered.
I did a little reading here on the forums and I ran across nDPI, however, it appears this functionality has been removed from iptables (or, I can't find an easy way to enable it anyway) with the only nDPI package I've been able to locate being libndpi.
Is there any way to accomplish this easily? That being said, I don't mind taking a hard way as I see everything as a learning experience!