Hi @Jacko_ 

Thanks for posting in our business forum.

Use GW ACL. GW ACL is stateful while the SW ACL is stateless.

How to implement unidirectional VLAN access through ACL configuration on the Omada Gateway in Controller mode

  @Jacko_ 

Jacko_ wrote

  @Clive_A 

 

Ok i created the GW ACL rule for the IoT vlan and while it's blocking access to the rest of my vlans, but I can ping the other direction i still have 30 devices that do not get a new IP from DHCP.

 

I'm also having an issue where a server VM inside Proxmox on a separate vlan can access the internet and this VM can ping the web and all vlans - i have not created an ACL yet.  But what is strange is i can not ping the VM from another vLAN.  I do have the switch port configured for this vlan.  Strange, I'm just not sure what is going on with this.

 

Lastly, can you explain the difference between stateful and stateless when it comes to the ACL rule?  creating the rule at the Gateway level rather than switch i guess means the ACL rule will propagate all TP-Link devices on the network?

 

Thanks again

It is not proprietary.

1. ACL keeps track of the state of each network connection.
2. It monitors and remembers the status, sequence numbers, and other parameters associated with a connection.
3. This type of ACL allows traffic based on the context or history of previous packets in a session.
4. Stateful firewalls use this approach to allow inbound traffic that is part of an established outbound connection while blocking all other incoming requests.

By default, VLAN interfaces allow access between each interface. If it can access other interfaces, you should check if you have properly configured it or is it under the config.