@Death_Metal 

Thanks Clive. I added a Gateway Version of the Configuration so that it will fit either section :)...but I agree, I think this should be in the Switch section. Is it possible you can move this thread to that section? If not, let me know and I will repost.

Thanks!

  @Death_Metal 

hey thanks for your work! I created an L3 switch configuration from this post:

https://community.tp-link.com/en/business/forum/topic/650966

This works 100%! The network traffic goes through the switch and only the internet goes through the gateway

I have problems with the Switch-ACL:

Test-System:
ER605 v1 Gateway
SG2210P v5 Switch

Interface:
LAN (Default)
192.168.0.1/24
HOME
VLAN 100
SERVER
VLAN 200

Switch L3 Config:
HOME Vlan 100 = 192.168.100.1/24
SERVER VLAN 200 = 192.168.200.1/24

I have 2 clients:
Port 1 (Home) = Laptop with 192.168.100.100
Port 2 (Server) = RasperryPi with 192.168.200.100
I have 100% access to Pi via SSH and everything works!
now I want to access from home to server but server doesn't have access to home. This with your instructions here

I create your ACL rules with SSH:

Switch ACLs:

1. Permit Home devices to SSH to Server devices
   Switch ACLs (Layer 3 Switching Version):
   Permit Home SSH to Server
   Policy: Permit
   Protocols: All
   Source > IP Port Group > (Subnet 192.168.100.0/24, Port: 22)
   Destination > IP Group > (Subnet 192.168.200.0/24)
2. Deny Server To Home
   Policy: Deny
   Protocols: All
   Source > IP Group > (Subnet 192.168.200.0/24)
   Destination > IP Group > (Subnet 192.168.100.0/24)

 

Now with this rule, Home no longer has access to Server 
In my example:

Port 1 (Home) = Laptop with 192.168.100.100
can no longer access
Port 2 (Server) = RasperryPi with 192.168.200.100
 

why doesn't this work for me?
I'll show you a few more pictures:

Interfaces:

 

L3 Switch config (example "Home", also Server only with 192.168.200.1):

 

ACL Rule:

HOME_SSH = IP-Port: 192.168.100.0/24 Port:22
HOME_ALL = IP: 192.168.100.0/24
SERVER_ALL = IP: 192.168.200.0/24

In my tests it's like this when the rule "Deny Server to ALL" is created then everything stops working.
Home can no longer reach Server and Server cannot reach Home. even if a rule is created with "Permit".
a "Deny" rule prevents all communication.. like "Bi-directional"
(Yes, i use Putty and the Pi SSH Port is default "22")

I hope you can help me, I'm desperate

Hello   @Clive_A  and @EliteAustria

There are two ways to go about this. I agree with Clive that if you want a non-granular (IP  Port Group-based) ACL, then you have to use Gateway ACL.If you go the Gatewat ACL route, you can never have Granular (IP Port-Group-based) ACL meaning, your Source from one ACL Rule can NEVER be a Destination with another ACL Rule. You can request a feature to support IP Port Group for Gateway ACL if you need to.

The second way is, just go fuill Switch ACL and follow my posted guide. In your ACL, in your question why it works that way, it is because it's supposed to work that way. If you want Server to have "granular" access to home, I edited your posted ACLs, and inserted ACL Line 2 and edited ACL Line 3 (your old ACL 2) to demonstrate this. it will allow your Home to SSH to Server devices, BUT also allowing Server devices to FTP to Home devices (assuming there's an FTP server/service running in Home VLAN 100) . This can never be done with Gateway ACLs (maybe in the future it will).

Switch ACLs:

1. Permit Home devices to SSH to Server devices
   Permit Home SSH to Server
   Policy: Permit
   Protocols: All
   Source > IP Port Group > (Subnet 192.168.100.0/24, Port: 22)
   Destination > IP Group > (Subnet 192.168.200.0/24)
2. Permit Server devices to FTP to Home devices
   Permit Server FTP to Home
   Policy: Permit
   Protocols: All
   Source > IP Group > (Subnet 192.168.100.0/24)
   Destination > IP Port Group > (Subnet 192.168.200.0/24, Port: 21)
3. Deny Home devices to access Server resources
   Deny Home to Server
   Policy: Deny
   Protocols: All
   Source > IP Group > (Subnet 192.168.100.0/24)
   Destination > IP Group > (Subnet 192.168.200.0/24)

Remember this tip, which I covered in my past ACL videos: Default is Permit All, You allow what you Deny, and Whitelisting (Deny some/Permit Some).

Look at all "Sources" in those 3 ACLs and you will see what is "common". ALL the Permit's Source is the Deny's Source aka Home (in my example IoT)! In your original ACL, you Denied "Server to Home" (VLAN 200) and then "Permitted Home to Server" (VL:AN 100) but there is no need to Permit Home because (remember the tip) the default is Permit All and the only Permit you need to do is IP Port Group (remember the tip Whitelisting). Because if you Permit everything anyway, there is no need for ACL (remember the tip: you allow what you Deny).

Now another tip using the ACLs above, I used SSH and FTP, but you can use any protocols, known or custom one. If you would like to "observe" the functionalities of the ACLs, change ACL #2 from Port 21/FTP to Port 22/ssh. For testing, always have ACL 3 as ON. Now play around with ACL 1 and 2, turning them On/Off, Off/On, On/On, Off/Off or however you want. Each time you turn On or Off an ACL, do an SSH From Home to Server, then from Server to Home. Observe how they work. Work slowly, and be patient because ACLs can sometimes take time. So start with just ACL 3 On, then wait a bit: ssh (on either). Then Turn On ACL x, then wait a bit: ssh (on either). Rinse/repeat. Hopefully this will get you more familiarized with how the ACLs are structured and how they work.

I hope I don't get you confused even more. I know this is a confusing subject, I have been covering Omada ACLs for 3-4 years now and I think some of my viewers did get it but for the most part, I still don't know how to properly explain it :) :) :). I came up with it because there was no Stateful ACL for the longest time and so many users complained they can't do stuff but I keep telling showing how to do stuff but I keep failing to explain properly haha :)

Check this video and maybe it can also shed some light. Sorry for late reply, and Good hunting!

Hi  @EliteAustria ,

I didn't track Clive's reply in another post and the OP's reply doesn't seem to conform to your use case (deny server to home)...

Here's how I look at it.

Your deny switch ACC for your use case is correct.

1. ...
2. Deny Server To Home
   Policy: Deny
   Protocols: All
   Source > IP Group > (Subnet 192.168.200.0/24)
   Destination > IP Group > (Subnet 192.168.100.0/24)

But because Switch ACLs are stateless, a better description of what's going on is that all traffic from Server to Home is blocked.

That includes traffic initiated from Server towards Home BUT ALSO reply traffic from Server to Home (in response to requests initiated from Home).

When you SSH from a client in Home to your RPi in Server, the requests go through (allowed by default) but the replies from the RPi are blocked.

Your first ACL is

1. Permit Home devices to SSH to Server devices
   Switch ACLs (Layer 3 Switching Version):
   Permit Home SSH to Server
   Policy: Permit
   Protocols: All
   Source > IP Port Group > (Subnet 192.168.100.0/24, Port: 22)
   Destination > IP Group > (Subnet 192.168.200.0/24)

It's incorrect because your SSH server (listening on port 22 and replying through that connection) is in the 200 subnet.

The correct ACL is:

1. Permit Home devices to SSH to Server devices (Reverse / Replies)
   Switch ACLs (Layer 3 Switching Version):
   Permit Home SSH to Server
   Policy: Permit
   Protocols: All
   Source > IP Port Group > (Subnet 192.168.200.0/24, Port: 22)
   Destination > IP Group > (Subnet 192.168.100.0/24)

In other words, you specifically allow reply traffic from allow all standard SSH servers/hosts in Server back to any clients in Home, which is otherwise blocked by ACL2.

I'll admit that the first time I saw such ACL, I thought it was a mistake... A server associated port in a source didn't make sense to me at first.

This said, if this are the only rules you have, you are better off with a simpler GW ACL (LAN->LAN Server to Home).

Such ACL is stateful and only blocks traffic initiated from Server to Home (doesn't affect replies).

One ACL and you're done.

HTH