Firewall rule? Route? Both?

Hello all,

I’ve recently setup HomeAssistant (HA) and everything has been going well except for one thing.

I have my network segmented using vlans and have a total of 3 networks. LAN, IoT, and Guest. It’s been working great for me for several years now. I only use 3 devices on my LAN. My phone, my laptop, and my PS4. I have the firewall configured so that the LAN network can access the IoT and the WAN, but the IoT network can only access the WAN.

I have the HA on my IoT network to simplify configuring and for the ease of use using its discovery to find all my IoT devices. All of that has worked excellent.

However, now I want to add the PS4 integration to HA. The easy way is to simply put my PS4 on the IoT network, yes, this is I know. But I’m a knucklehead and don’t want to do that. I want to keep it on my LAN network if at all possible. I’ve tried setting Traffic Rules in the firewall so only the HA can access LAN devices, but to no avail.

Does anyone have any advice for how I would/could achieve this? Or is this a pipe dream because I have the main firewall config setup so that IoT network can’t access LAN network and there’s no way around it without changing the main config. I’m hoping I can do this with a simple traffic rule.

This is easily possible with some firewall rules. Let’s see your config files, and we also need to know the ip of your ha server.

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

cat /etc/config/network
cat /etc/config/firewall

That would be phenomenal. Thank you!

The ha server ip - 172.18.6.200

/etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdca:1aba:ed::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan'

config interface 'lan'
        option device 'br-main'
        option proto 'static'
        option ipaddr '172.18.3.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option defaultroute '0'
        list ip6class 'local'
        list ip6class 'wan6'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'
        option broadcast '1'
        option hostname '*'
        option metric '0'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config bridge-vlan
        option device 'br-lan'
        option vlan '1'
        list ports 'lan:u*'

config bridge-vlan
        option device 'br-lan'
        option vlan '3'
        list ports 'lan:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '4'
        list ports 'lan:t'

config device
        option name 'br-lan.1'
        option type '8021q'
        option ifname 'br-lan'
        option vid '1'

config device
        option name 'br-lan.3'
        option type '8021q'
        option ifname 'br-lan'
        option vid '3'

config device
        option name 'br-lan.4'
        option type '8021q'
        option ifname 'br-lan'
        option vid '4'

config device
        option name 'eth0'

config device
        option name 'lan'

config device
        option name 'wan'

config interface 'bat0'
        option proto 'batadv'
        option routing_algo 'BATMAN_V'
        option bridge_loop_avoidance '1'
        option gw_mode 'server'
        option hop_penalty '30'

config interface 'batmesh'
        option proto 'batadv_hardif'
        option master 'bat0'

config interface 'IoT'
        option proto 'static'
        option device 'br-IoT'
        option ipaddr '172.18.6.1'
        option netmask '255.255.255.0'
        option defaultroute '0'
        option ip6assign '64'
        list ip6class 'local'
        list ip6class 'wan6'

config interface 'guest'
        option proto 'static'
        option device 'br-guest'
        option ipaddr '192.168.9.1'
        option netmask '255.255.255.0'
        option defaultroute '0'

config interface 'modem'
        option proto 'static'
        option device '@wan'
        option ipaddr 'xxxxxxxx'
        option netmask '255.255.255.0'


config interface 'wg0'
        option proto 'wireguard'
        option force_link '1'
        option private_key '+xxxxxxxxxxxxxxxxxxxxxx'
        option listen_port '51820'
        list addresses '10.14.0.1/24'
        option metric '10'

config device
        option name 'bat0'

config device
        option name 'wg0'

config device
        option name 'mesh0'

config device
        option type 'bridge'
        option name 'br-main'
        list ports 'bat0.1'
        list ports 'br-lan.1'
        option bridge_empty '1'

config device
        option name 'bat0.1'

config device
        option type 'bridge'
        option name 'br-IoT'
        list ports 'br-lan.3'
        list ports 'bat0.3'
        option bridge_empty '1'

config device
        option type 'bridge'
        option name 'br-guest'
        list ports 'br-lan.4'
        list ports 'bat0.4'
        option bridge_empty '1'

config device
        option name 'bat0.3'

config device
        option name 'bat0.4'

config device
        option name 'wg1'

config device
        option name 'phy0-ap0'

config device
        option name 'phy1-ap0'

config device
        option name 'phy1-ap1'

config device
        option name 'phy1-ap2'

/etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'
        option drop_invalid '1'
        option flow_offloading '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        list network 'wg0'
        option masq '1'
        option mtu_fix '1'

config zone
        option name 'wan'
        option input 'DROP'
        option output 'ACCEPT'
        option forward 'DROP'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'
        list network 'modem'

config zone
        option name 'protonvpn'
        option input 'DROP'
        option output 'ACCEPT'
        option forward 'DROP'
        list network 'wg1'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config include 'pbr'
        option fw4_compatible '1'
        option type 'script'
        option path '/usr/share/pbr/pbr.firewall.include'

config include 'bcp38'
        option type 'script'
        option path '/usr/lib/bcp38/run.sh'

config zone
        option name 'IoT'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'IoT'

config zone
        option name 'guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'guest'

config forwarding
        option src 'lan'
        option dest 'IoT'

config forwarding
        option src 'guest'
        option dest 'wan'

config forwarding
        option src 'IoT'
        option dest 'wan'

config forwarding
        option src 'guest'
        option dest 'protonvpn'

config redirect
        option target 'DNAT'
        option name 'Intercept-LAN-DNS'
        option src 'lan'
        option src_dport '53'

config redirect
        option target 'DNAT'
        option name 'Intercept-IoT-DNS'
        option src 'IoT'
        option src_dport '53'

config redirect
        option target 'DNAT'
        option name 'Intercept-Guest-DNS'
        option src 'guest'
        option src_dport '53'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'WireGuard-Inbound'
        list proto 'udp'
        option src 'wan'
        option src_dport '51820'
        option dest_ip '172.18.3.1'
        option dest_port '51820'

config forwarding
        option src 'lan'
        option dest 'IoT'

config forwarding
        option src 'guest'
        option dest 'wan'

config forwarding
        option src 'IoT'
        option dest 'wan'

config forwarding
        option src 'guest'
        option dest 'protonvpn'

config redirect
        option target 'DNAT'
        option name 'Intercept-LAN-DNS'
        option src 'lan'
        option src_dport '53'

config redirect
        option target 'DNAT'
        option name 'Intercept-IoT-DNS'
        option src 'IoT'
        option src_dport '53'

config redirect
        option target 'DNAT'
        option name 'Intercept-Guest-DNS'
        option src 'guest'
        option src_dport '53'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'WireGuard-Inbound'
        list proto 'udp'
        option src 'wan'
        option src_dport '51820'
        option dest_ip '172.18.3.1'
        option dest_port '51820'
        option enabled '0'

config rule
        option name 'Allow-WireGuard-Inbound'
        list proto 'udp'
        option src 'wan'
        option dest_port '51820'
        option target 'ACCEPT'

config rule
        option name 'Support-UDP-Traceroute'
        list proto 'udp'
        option src 'wan'
        option dest_port '33434-33689'
        option target 'REJECT'

config rule
        option name 'IoT DHCP/DNS'
        option src 'IoT'
        option dest_port '53 67 68'
        option target 'ACCEPT'


You could also just make HA available on both networks.

Try:

config rule
        option name 'HA to PS4'
        option src 'IoT'
        option src_ip '172.18.6.200'
        option dest 'lan'
        option dest_ip 'Replace with PS4 ip'
        option target 'ACCEPT'

I've tried that by doing this rule -

config rule
        option name 'HA to LAN'
        option src 'IoT'
        option src_ip '172.18.6.200'
        option dest 'lan'
        option target 'ACCEPT'

but it didn't work... or maybe it did but it's not the culprit for my issue. The PS4 integration for HA requires a third party app (I'm using iPhone) called "PS4SecondScreen" and upon further research, some apps require hardware to be on the same network/subnet depending on the protocol it uses for discovery. So I might just be SOL if that happens to be the reason why HA doesn't discover my PS4 during the config process.

I've tried something similar but just allowing access to the LAN entirely with no luck. I mention a possibility as to why in the post above. I will try defining the PS4 ip in the rule to see if that helps.

Does the PS4 + HA integration work using direct IP address access, or does it expect to be able to function based on autodiscovery/mdns type methods? The latter will only work when both devices are on the same subnet, but you may be able to use an mdns reflector/repeater to allow this traffic to be routed between the two networks.

Yes, I've put the PS4 on the IoT network and it works as it should. That's exactly what I'm thinking. In my research, I haven't been able to find out what discovery method the third party app uses. I've tried a plethora of different rules and routes with no success, which leads me to assume that the app is wanting the HA and the PS4 to be on the same subnet because the issue is actually a discovery limitation of the app. I'll have to look into mdns reflector/repeater as a possible workaround. I've no idea where to start with that other than a Google search and searching on this forum. Thanks for the tip.

I’ve tried mDNS reflector using avahi-dbus-daemon with no luck.

Next, I’ll try with the igmp proxy, but I have to head to work now. I’ll report back with the results later tonight/tomorrow.

I tried IGMP proxy with no luck as well. I'm in over my head trying to wrap my head around this. I guess I'll do without for now and try again another time. Oh well... :man_shrugging:

I’m not sure if you are still trying to solve the issue with your devices being on a different subnet than your home assistant instance. Maybe my reply a few days ago wasn’t clear enough due to the lack of time I had so I will try again…

As I told you before:

How to do that? By simply adding a second (virtual) nic to your home assistant assigned to another network... in your case your LAN network. How can you add a second nic to HA? This probably depends what version/installation method of HA you use. I’m using HAOS = Home Assistant OS in a virtual machine on my proxmox Server and this is what I did (maybe it will help you):

  • I first created a new Vlan aware network bridge in Proxmox

  • added the bridge as a new network device to my HA VM and rebooted the VM

  • After that I went to HA/Settings/System/Network and unchecked “Auto configure” under Network Adapter and activated my new network adapter. Looks like this:

  • Maybe a reboot of HA is needed

  • Lastly, I configured the new network interface with a static ip:

Now I can control any devices in both networks (LAN and IOT) via HA event though my firewall is blocking forwarding from IOT zone to LAN.
Hope this helps in any way...

2 Likes

You hit the nail on the head. I happened upon a tutorial to do this and went this route and got it working. Yes, your initial comment went right over my head lol. But I appreciate it nonetheless.

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.