Only Allow Access Internal Network (Including Remote Through VPN) on Some Device
Hello, I have a setup similar to the diagram above, with the difference being gateway A and B controlled by OC200 in HQ. I'm trying to setup some device to only be able to access internal network.
I followed the guide from https://community.tp-link.com/en/business/forum/topic/696340, and it works well as expected for most of the part, but now the device on HQ cannot connect to the device on Branch Office and vice versa.
How do I create an ACL rule that allow both internal network, and remote network that is connected through VPN?
Thank you,
Nikolas
Hi @Nikolassss
Thanks for posting in our business forum.
Nikolassss wrote
Okay, so here is a simplification of my network. In my case, Device A, B, C, and D can communicate with each other thanks to Wireguard VPN. I want to keep it that way but, I want to block Device D's access to the Internet.
When I create ACL Rule to DENY device D access from LAN->WAN as shown above, Device D's access to internet is blocked successfully. BUT it also blocked Device D to Device A and B. Device D can still access Device C in this case, which is expected from the ACL rule.
Is ACL not the right tool for this?
OK. I have an idea.
If you create this block LAN > WAN. Then create another one to allow Device D to access the WG interface IP address.
That should fix it?
When you block, you use any IP, that might stop the connection to the WG int IP as well. Hope this idea helps.
Hello @Clive_A, Thank you for your reply.
Correct, The VPN setup is using WireGuard, and it has been working well to allow device from HQ to communicate with device in Branch Office and vice versa. This was set up using the allowed IPs as you mentioned.
My current problem is: I want to have some device to only able to access internal network (a.k.a block access to internet to some device only). BUT, when I set the ACL rule to deny the IP group access to the WAN, it also deny access to other devices on the other site (HQ to Branch and vice versa)
The desired output I'm looking for is: The devices that has it's access blocked to the WAN, can still communicate with devices BOTH on local network, and on the remote network that is connected through Wireguard VPN.
Please give me some guidance, and any help would be appreciated.
Thank you,
Nikolas
Okay, so here is a simplification of my network. In my case, Device A, B, C, and D can communicate with each other thanks to Wireguard VPN. I want to keep it that way but, I want to block Device D's access to the Internet.
When I create ACL Rule to DENY device D access from LAN->WAN as shown above, Device D's access to internet is blocked successfully. BUT it also blocked Device D to Device A and B. Device D can still access Device C in this case, which is expected from the ACL rule.
Is ACL not the right tool for this?
Hi @Nikolassss
Thanks for posting in our business forum.
Nikolassss wrote
Okay, so here is a simplification of my network. In my case, Device A, B, C, and D can communicate with each other thanks to Wireguard VPN. I want to keep it that way but, I want to block Device D's access to the Internet.
When I create ACL Rule to DENY device D access from LAN->WAN as shown above, Device D's access to internet is blocked successfully. BUT it also blocked Device D to Device A and B. Device D can still access Device C in this case, which is expected from the ACL rule.
Is ACL not the right tool for this?
OK. I have an idea.
If you create this block LAN > WAN. Then create another one to allow Device D to access the WG interface IP address.
That should fix it?
When you block, you use any IP, that might stop the connection to the WG int IP as well. Hope this idea helps.
