USG310 - Block traffic to Management but not to Internet

Lukas0102
Lukas0102 Posts: 11
Friend Collector Second Anniversary
in Security
Hello,

I'm really struggling on this one. 

I have an USG310 and NWA5123 as AP. Maybe the problem is easier than I think to solve but I just can't figure it out.

The USG is accessible under the default IP 192.168.1.1 and for the AP I set 192.168.10.1. Now I wan't to block the connection to 192.168.1.1 for the AP.

I think there is a specific firewall rule which I need to set but I didn't find them yet.

One thing I tried is block AP traffic to ZyWall but if I do this, the AP shows as offline in AP Management.

For managing the Switch I'm using LAN on a other port than the AP.

Accepted Solution

  • Zyxel_Tobias
    Zyxel_Tobias Posts: 200  Zyxel Employee
    5 Answers First Comment Friend Collector Sixth Anniversary
    Answer ✓
    Hi @Lukas0102

    True, you need to block AP to ZyWALL but if ZyWALL manages this AP you need 2 rules:

    a) Allow AP to ZyWALL with "Services: CAPWAP"
    b) Block AP to ZyWALL with any services

    So you can make sure your Management WIFI is working, but PING is blocked

    Also, you can do:

    a) Block "AP to ZyWALL" with Service "PING"
    b) Allow "AP to ZyWALL" with Service "Any"

    To may not run into more Port block issues.

    Kind Regards,
    Tobias

All Replies

  • Zyxel_Tobias
    Zyxel_Tobias Posts: 200  Zyxel Employee
    5 Answers First Comment Friend Collector Sixth Anniversary
    Answer ✓
    Hi @Lukas0102

    True, you need to block AP to ZyWALL but if ZyWALL manages this AP you need 2 rules:

    a) Allow AP to ZyWALL with "Services: CAPWAP"
    b) Block AP to ZyWALL with any services

    So you can make sure your Management WIFI is working, but PING is blocked

    Also, you can do:

    a) Block "AP to ZyWALL" with Service "PING"
    b) Allow "AP to ZyWALL" with Service "Any"

    To may not run into more Port block issues.

    Kind Regards,
    Tobias
  • Lukas0102
    Lukas0102 Posts: 11
    Friend Collector Second Anniversary
    Zyxel_Tobias said:
    Hi @Lukas0102

    True, you need to block AP to ZyWALL but if ZyWALL manages this AP you need 2 rules:

    a) Allow AP to ZyWALL with "Services: CAPWAP"
    b) Block AP to ZyWALL with any services

    So you can make sure your Management WIFI is working, but PING is blocked

    Also, you can do:

    a) Block "AP to ZyWALL" with Service "PING"
    b) Allow "AP to ZyWALL" with Service "Any"

    To may not run into more Port block issues.

    Kind Regards,
    Tobias
    Thanks for the answer. I forgot to set a custom DNS instead of the ZyWALL for the AP zone... :s

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）