@Fae
1. I first tried to block from source: Private to destination: Me but this did not have the desired effect, I'll have to check again to see what was wrong in that case.

2. Thank you for confirming that unidirectional ACL is not possible. Is this only the case for "LAN->LAN" rules or also for rules with "ALL" direction? I did find on the support website that it is possible on the ER7206 for "ALL" direction rules, can this functionality be ported to ER605 in the next firmware release? This is required for me to implement a sort of admin network that can access multiple other VLANs but not vice-versa.

  @Arion

1. I was wondering the same about accessing web services on those ports, but to be honest I tested a bunch of stuff until I was able to access the internet and not able to access the management page from outside the MGMT VLAN and then kept those settings. With all these weird quirks I also don't fully understand the rationale behind it. I didn't create an allow rule because I guess that everything which is not blocked will be allowed, so it is implicit.

2. Looking at the ER7206 documentation I linked above, it seems that Source and Destination are not mixed up and are logical to what I would expect. Of course if all rules are bidirectional by default on the ER605 then it doesn't really matter...

3. I'm indeed using a beta that has a quickfix for DHCP issues which is supposed to be integrated into the next official release.

@Fae

Following your instructions I have successfully configured the ER605 v1 in v1.2.1 firmware to block inter-vlan. Creating rules for each vlan(x) to !vlan(x). I have done some tests and it seems ok. The memory usage was not affected, either.

@K_verb 
Thanks to your advice, I have also managed to create exclusive access for one vlan to the router's management page, blocking others from it.

First I tried with All Service Type (with !myvlan to Me) that unfortunately blocked the whole router and I had to push reset and reboot it. Your hint to block only http and https seems to work.

I really hope nobody on the local network will have any issue with it. It seems it doesn't affect internet traffic, I tried to test it with some apps, I don't know what should be the more appropriate to use for testing http port 80 and https port 443. (oh... I forgot to test Mail app... Have you checked it in your network?) I live far from the router's location and I got already back home.

Besides, there are still some less important bugs remaining:

- VLAN list order still misordered and we don't have the option to define ID order number for the VLANs.
- Traffic Statistics still buggy, shows inconsistent numbers and events.

And a more serious issue:
- Bandwidth Control with usage percentage configured: after any reboot or restrore it limits the bandwidth even if there is nobody else using the network, only me.

I had to turn the feature OFF and ON again in order for it to stop limiting traffic unnecessarily and changed the percentage to 90%. But it the issue reappears again, I'll have to disable it.

  @Arion 

Happy it works for you as well!

I also don't live at the site (yet... it's a renovation project). I do have a home automation system already running which regularly sends me emails, and with my phone and laptop I had no issue sending a test email today when connected to the router via VPN.

  @Arion 

Happy it works for you as well!

I also don't live at the site (yet... it's a renovation project). I do have a home automation system already running which regularly sends me emails, and with my phone and laptop I had no issue sending a test email today when connected to the router via VPN.

Fae wrote

choose source VLAN10 and destination !VLAN10 (no need to add a reflexive rule), then VLAN10 network will be isolated from all other VLANs and vice versa.

 

Please feel free to let me know if I can be of any further help here.

  @Fae 

Hello, just pickup one of these routers a week ago, v2 FW 2.0.1 Build 20220223. What is the status of the issues raised in this thread. I tried your above quote and it breaks the DHCP service for the source VLAN. Tried swapping the source and destination with the same result. Also interested in if/when the ACL is supposedly going back to unidirectional. I haven't tried the suggestion for blocking access to the router Web UI but expecting it to either not work or have issues as pointed out already when I do. Seems so far no one anywhere has been able to get this to work with NordVPN's implementation of OpenVPN due to a lack of somewhere to enter the credentials. Any Suggestions on that? TBH if I knew this product (V1) was released barely passing/functional as a "SMB" or "VPN" router and has had nothing but issues since I would have gotten something from another vendor. Chose it because I have been happy with my TP-Link switch.

Edit: Tried blocking the web UI and it worked fine without having to open port 80 or 443 as others stated. Another very basic/critical feature missing is the ablity to block/allow LAN>LAN comunication with IPGROUPS. Currently can only do a blanket block/allow for entire LAN's without being able to let select IP's through.

Thanks

  @Fae 

Fae wrote

choose source VLAN10 and destination !VLAN10 (no need to add a reflexive rule), then VLAN10 network will be isolated from all other VLANs and vice versa.

 

Please feel free to let me know if I can be of any further help here.

Hello, just pickup one of these routers a week ago, v2 FW 2.0.1 Build 20220223. What is the status of the issues raised in this thread. I tried your above quote and it breaks the DHCP service for the source VLAN. Tried swapping the source and destination with the same result. Also interested in if/when the ACL is supposedly going back to unidirectional. I haven't tried the suggestion for blocking access to the router Web UI but expecting it to either not work or have issues as pointed out already when I do. Seems so far no one anywhere has been able to get this to work with NordVPN's implementation of OpenVPN due to a lack of somewhere to enter the credentials. Any Suggestions on that? TBH if I knew this product (V1) was released barely passing/functional as a "SMB" or "VPN" router and has had nothing but issues since I would have gotten something from another vendor. Chose it because I have been happy with my TP-Link switch.

Edit: Tried blocking the web UI and it worked fine without having to open port 80 or 443 as others stated. Another very basic/critical feature missing is the ablity to block/allow LAN>LAN comunication with IPGROUPS. Currently can only do a blanket block/allow for entire LAN's without being able to let select IP's through.

Edit 2: Seems blocking the web UI is not without issues. If I block "LAN1" & "LAN3", it works as expected. If I block "!LAN2", it breaks the internet for LAN1 & LAN3. 

This router has so many bugs and issues with the access control, I'm seriously wondering how I'm supposed to trust this thing. I really can't, the amount of time that would have to be spent with wireshark to be able to is not worth the $60 it cost. Out $60 and still need a functioning router that isn't still in beta.

Thanks

PiGuy wrote 

Another very basic/critical feature missing is the ability to block/allow LAN>LAN communication with IPGROUPS. Currently can only do a blanket block/allow for entire LAN's without being able to let select IP's through.

Edit 2: Seems blocking the web UI is not without issues. If I block "LAN1" & "LAN3", it works as expected. If I block "!LAN2", it breaks the internet for LAN1 & LAN3.

  @PiGuy 

In the above printscreen you can see that I allowed access for a specific VLAN (Vlan217) to another VLAN (switch_1 and switch_2) before blocking inter-vlan communication for the rest of the local network. And blocked access outside of a specific IPGROUP (_A27_) – using ! – via http and https, in this case the source must be Me.