I am currently redoing my home/home office network. My setup is slightly unusual in that the WAN entrance is at an outbuilding then distributed to another outbuilding and then to the house.

Our previous residence was a simple wired LAN. We now live in a rural area on 3.5 acres of wooded property. I am a semi-retired general contractor who still does part time consulting. I am not an IT person so hopefully this makes sense.

Current equipment I have installed:

Outbuilding #1(Workshop); WAN, ER650p, OC200, SG2008p, EAP 610 (at far end of building), EAP625 (at exterior front of building to cover outdoors to rear of house), EAP-211 wireless bridge to outbuilding #2.

Outbuilding #2 (Office); EAP-211 wireless bridge from Outbuilding #1, 2x SG2008p. The office is a wired LAN.

House: EAP625 on the exterior front direct wired to the office. This covers the front part of the house and property.

#1. I have configured 5 networks. The main LAN which is my office and 4 VLANs (Shop, Home, Shared, Guest). Everything is setup, connected, updated and working properly.

Where I am struggling now is setting up the ACLs and device sharing.

I want to prohibit the Home, Shared and Shop VLANS from accessing the Office LAN but the Printer is in the Office, and I want the Home and Shop VLANs to be able to access it.

Below is what I could find online by creating an IP Group for the printer.

ACL 1: [Policy: Allow], [Protocols: All], [Source: IP Group- OfficePrinter (Printer has static IP)], [Destination: Network – Home, Shared Shop], [ACL Binding – Ports, All Ports].

ACL 2: [Policy: Deny], [Protocols: All], [Source: Network – Home/Shop/Shared], [Destination: Network – Office], [ACL Binding – Ports, All Ports].

Unfortunately, this does not work. If I turn off ACL 2, I can configure IPP printers across the VLANs.

The other solution I ran across online was configuring mDNS across the VLANS. I haven’t gone down that rabbit hole yet as I haven’t found an example of how that works.

#2. Also in my office is a NAS I use as a media server. I need to connect this to the Roku device in the house which is on the Shared VLAN. I prefer the NAS to stay in the office since it does backups to my Backup NAS, also in the office.

Any insight or direction would be appreciated.