VLAN Inter-Zone accessibility control configuration example: Difference between revisions
No edit summary |
No edit summary |
||
| Line 1: | Line 1: | ||
<p style="color:red">The information | <p style="color:red">The information on this page is updated in accordance with firmware version '''[https://wiki.teltonika-networks.com/view/FW_%26_SDK_Downloads 00.07.13.1]'''. | ||
==Introduction== | ==Introduction== | ||
In this example we will show how to manage VLAN to VLAN communication with either '''one''' firewall zone or '''multiple''' firewall zones. | In this example we will show how to manage VLAN to VLAN communication with either '''one''' firewall zone or '''multiple''' firewall zones. | ||
==Setting up VLANs== | ==Setting up VLANs== | ||
In this example, we are assuming that the VLANs are already set up | In this example, we are assuming that the VLANs are already set up; we will configure the firewall accordingly. If you need information on how to create VLANs on your device, please refer to this article: [[VLAN_Set_Up|VLAN set up]]. For this article, we have 3 separate VLANs created: | ||
*lan | IP 192.168.1.1/24 | *lan | IP 192.168.1.1/24 | ||
*lan2 | IP 192.168.2.1/24 | *lan2 | IP 192.168.2.1/24 | ||
| Line 29: | Line 26: | ||
[[File:Allowlan1tolan2pingoriginal.png|border|class=tlt-border|]] | [[File:Allowlan1tolan2pingoriginal.png|border|class=tlt-border|]] | ||
To disable VLAN to VLAN communication, navigate to '''Network -> Firewall -> | To disable VLAN to VLAN communication, navigate to '''Network -> Firewall -> Zones'''. Press '''Edit''' on the '''LAN''' zone (lan => wan). | ||
[[File: | [[File:Editfwzonev2.png|border|1100x1100px]] | ||
Click on ''' | Click on '''Intra zone forward''' and select '''Drop or Reject'''. Make sure that all created VLANs are added in the Covered networks tab: | ||
[[File: | [[File:Disablevlan2vlandefaultv3.png|border]] | ||
Now if we try to reach lan2 from lan, the devices are not able to communicate: | Now if we try to reach lan2 from lan, the devices are not able to communicate: | ||
| Line 47: | Line 44: | ||
[[File:3zonetopology.png|600px|border|class=tlt-border]] | [[File:3zonetopology.png|600px|border|class=tlt-border]] | ||
To start with, we will need to create new firewall zones: LAN1, LAN2 and LAN3. To add new zones, navigate to '''Network -> Firewall -> | To start with, we will need to create new firewall zones: LAN1, LAN2 and LAN3. To add new zones, navigate to '''Network -> Firewall -> Zones'''. In the Zones section, press [[File:Add Button.png|60x90px]] to add a new zone. | ||
[[File: | [[File:Addnewfwzone1v2.png|border|1100x1100px]] | ||
A new window will open, there configure the settings according to the points below and press [[File:Save & Apply.png|100x30px]].: | A new window will open, there configure the settings according to the points below and press [[File:Save & Apply.png|100x30px]].: | ||
| Line 55: | Line 52: | ||
<tr> | <tr> | ||
<th width=400; style="border-bottom: 1px solid white;></th> | <th width=400; style="border-bottom: 1px solid white;></th> | ||
<th width=600; style="border-bottom: 1px solid white"; rowspan=2>[[File: | <th width=600; style="border-bottom: 1px solid white"; rowspan=2>[[File:Interzonecreationv3.png|border|right]]</th> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
| Line 62: | Line 59: | ||
# Input: '''Accept''' | # Input: '''Accept''' | ||
# Output: '''Accept''' | # Output: '''Accept''' | ||
# | # Intra zone forward: '''Reject''' | ||
# Covered networks: '''lan''' | # Covered networks: '''lan''' | ||
</td> | </td> | ||
</tr> | </tr> | ||
</table> | </table> | ||
'''Note''': By setting the Input and Output zones to '''Accept''' traffic is allowed to enter and leave the zone. ''' | '''Note''': By setting the Input and Output zones to '''Accept''' traffic is allowed to enter and leave the zone. '''Intra zone forward: Reject''' blocks communication between zones - this is a default policy. '''Inter-zone forwarding''' section can be used to modify the default behavior of the Forward zone and allow communication between zones. | ||
---- | ---- | ||
| Line 78: | Line 75: | ||
* Input: '''Accept''' | * Input: '''Accept''' | ||
* Output: '''Accept''' | * Output: '''Accept''' | ||
* | * Intra zone forward: '''Reject''' | ||
* Covered networks: '''lan2''' | * Covered networks: '''lan2''' | ||
| Line 86: | Line 83: | ||
* Input: '''Accept''' | * Input: '''Accept''' | ||
* Output: '''Accept''' | * Output: '''Accept''' | ||
* | * Intra zone forward: '''Reject''' | ||
* Covered networks: '''lan3''' | * Covered networks: '''lan3''' | ||
| Line 96: | Line 93: | ||
==Inter-zone forwarding use examples== | ==Inter-zone forwarding use examples== | ||
To customize communication between VLANs, we will need to edit Inter-zone forwarding rules. Navigate back to the firewall settings ('''Network -> Firewall -> | To customize communication between VLANs, we will need to edit Inter-zone forwarding rules. Navigate back to the firewall settings ('''Network -> Firewall -> Zones''') and edit zones according to your needs. | ||
---- | ---- | ||
| Line 104: | Line 101: | ||
<tr> | <tr> | ||
<th width=400; style="border-bottom: 1px solid white;></th> | <th width=400; style="border-bottom: 1px solid white;></th> | ||
<th width=600; style="border-bottom: 1px solid white"; rowspan=2>[[File: | <th width=600; style="border-bottom: 1px solid white"; rowspan=2>[[File:Intervlanzoneforwardv3.png|border|right]]</th> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||