Hi @Gooberry 

Thanks for posting in our business forum.

Don't get it.

If you are using VLAN interfaces, set up the ACL on the router or switch.

If you are not, and everything is under the same subnet, block everything in a format like 192.168.0.1/24 is incorrect.

IP Restriction is to restrict certain IPs from accessing it. Why block the whole subnet?

ARP can list the whole subnet regardless of what you configured. ACL on the router/switch can block ARP. However, blocking the ARP is never proper.

Hi @Gooberry 

Thanks for posting in our business forum.

Gooberry wrote

  @Clive_A 

I don't use VLAN's. I have everything on the 1 subnet. My point is I should be able to block using the /24 format. It is standard format and should be accepted in the firmware OS.

 

As I said, the setting allows blocking or allowing. Which means using the allow function, blocks everything outside it. Nice and simple. It is silly that the firmware does not support this.

Give me an example with IP specified(in CIDR format). What is included and excluded?

I failed to understand what you expect to do at the end of the day.

Hi @Gooberry 

Thanks for posting in our business forum.

Gooberry wrote

Clive_A wrote

 

Give me an example with IP specified(in CIDR format). What is included and excluded?

I failed to understand what you expect to do at the end of the day.

  @Clive_A 

As I said, I wish to setup a rule whereby I enter my entire LAN as a range e.g. 192.168.1/24 in the "allowed" field. Thereby blocking any external attempts to access the cameras or NVR.

 

Unfortunately the firmware does not support ranges. It only supports individual IP's. So this is a feature request I guess. So I see no reason why updating the firmware to allow for ranges cannot also be done. It is a reasonable request.

So, that's a request. Seems to be reasonable. But I discussed this with the test team.

What do you expect it to be in the end? Well, if your NVR is connected to the router/switch, you can set up the ACL on them to restrict access.

If you are not using the router/switch, you are simply using the NVR to be the DHCP server and you connect the computers without Internet access. Pure local network environment, the IP Restriction with a single block makes a lot of sense.

This is what I thought and the test team agreed with my opinion on this matter.