Lan VLAN access to Raspberry Pi Server on a separate VLAN

[nvvasilev]

Hello,
This is my first time writing on this forum.
Like a lot of you I wanted to separate my networks using VLANs so I ended up with 3 VLANs:

Default VLAN1 (LAN + WLAN) - trusted (client isolation disabled)
Guest VLAN3 (WLAN) - untrusted (client isolation enabled)
IoT VLAN6 (LAN + WLAN) - untrusted (client isolation disabled)

My idea is that the untrusted VLANs can not access the trusted 'lan' network but the 'lan' can access a HomeAssistant IoT device managment server on the 'iot' VLAN.

So..
With this setup it appears to me that the separation is working as I can not ping devices connected to the 'lan' VLAN from devices connected to the 'guest' or 'iot' VLANs. Nor can 'guest' VLAN connected devices ping 'iot' VLAN connected devices, nor can 'lan' VLAN connected devices ping 'guest' devices.

However 'lan' devices can ping 'iot' devices because of the lan -> iot forwarding zone rule.
Thus I am able to load the HomeAssistant home page from a 'lan' device by ip and port (192.168.6.100:8123 e.g.)
From within the 'iot' network I can access the server by the address name issued from DuckDNS (https://myhomeiot.duckdns.org e.g.)
I can not access the server from within the 'lan' VLAN with the address https://myhomeiot.duckdns.org!

Here are two topics I thought are the same as mine:

Vlans and port forwarding

hey guy, so here is my setup, i have two vlans 127, 100 and i set a port forwarding from the wan to web-server on vlan 127. all works as expected until im trying to reach the web server using the public ip from the 100 vlan pc. if i disconnect from wifi on my phone and use the mobile data i can reach the web-server without a problem . can someone please try to help me ill provide any information needed. thanks

Reach website from LAN in DMZ vlan

Hi, I have a website on my personnal server in a DMZ vlan. I configured port forwarding. It is working as expected from WAN to DMZ. My problem is when I try to join my website from my LAN vlan. I read the documentation. I enabled reflection but still not working. I think my problem is due to my DMZ vlan. NAT loopback (Reflection) is only working for a website in the same LAN. I found a discussion where someone proposed to add this : . /lib/functions.sh . /lib/functions/network.sh network_g…

In them @lleachii provided the solution to add a port forward rule to /etc/config/network:

config redirect
option target 'DNAT'
option src 'wan'
option proto 'tcp'
option src_dport '80'
option dest_port '80'
option src_ip '192.168.1.0/24'
option dest 'lan'
option dest_ip '192.168.y.xxx'
option name 'REDIRECT_HTTP_LAN'

Sad to say this did not work for me so I decided to look for help here.

I am happy to provide further info.

P.S. I am using screenshots as I find them more intuitive for a novice like me and I think it would help others get around easier.

[trendy]

Don't complicate things. Create a hostname under Network/Hostnames in Luci and assign there the duckdns name and the IP of the iot server.

[nvvasilev]

Thanks for the quick reply.
This works:

However now I have to specify the port after the address, like:
https://myhomeiot.duckdns.org:8123

And this makes an entirely different url and if I want to make a shortcut on my smartphone with it I have to have 2 shortcuts, one for the local network and one for WAN access.

[trendy]

Then fix the forward you have for Assistant SSL to use sdport 8123 instead of 443.

[nvvasilev]

Ok. So that way I am able to access the server using the same url https://myhomeiot.duckdns.org:8123 from everywhere (Lan VLAN, WAN and IoT VLAN).

The rule becomes:

I am greatful for your answer @trendy, just out of curiosity, what should I do if I don't want to use a port int the url, like that? Also is this a more secure approach compared to the port forwarding rule that @lleachii suggests?

I can see that by using this method, when testing my ports with https://www.grc.com/, port 443 is closed.

[trendy]

@nvvasilev

just out of curiosity, what should I do if I don't want to use a port int the url, like that?

Then you'll need 2 fowards from 443 to 8123, one from wan to iot and another from lan to iot.

@nvvasilev

Also is this a more secure approach compared to the port forwarding rule that @lleachii suggests?

They are the same. There is no security through obscurity.

[nvvasilev]

Awsome, thanks for the help and insight! I will mark your first reply as the answer!
I have another question related to this setup but I don't know if I should continue this thread with it?
Also I checked your profile and saw your github repo is NimaAra.. Is this you https://www.nimaara.com/ ?

[trendy]

Nope, I actually don't have github.

[nvvasilev]

Ahaha ok. Sorry.
Can I ask you another thing I am thinking about or should I open another topic?
If a smart TV on the IoT VLAN has to access a NAS on the trusted VLAN, can it be done with just a rule?

[trendy]

Yes, a firewall rule is enough.

[nvvasilev]

Is it enough without a zone forwarding like IoT -> Lan?

[trendy]

Zone forwarding will allow all iot zone to access lan.
You want only one IP, so a rule will do.

[trendy]

Please don't hijack others' threads. You can mention some user with the @ before their username. Moreover the answers you got from eduperez and mk24 should cover you and I don't have more to add.

[CyberHead]

sorry i will delete it, i don't see the solution to use my secondary lan☹️

[nvvasilev]

@trendy, thanks for all the help! I would like to ask you some more things but I would prefer to do it somewhere else not to cluter this topic. I don't see how I can direct message you in this forum. Could you provide some contact info (it's fine if you don't want to though).

[trendy]

Then it is better to start a new topic.