Hi @Nikolassss 

Thanks for posting in our business forum.

So is this based on the Wireguard? You've selected the Wireguard, so for the Wireguard, you should specify the network in the allowed IPs. That determines what's accessible or not.

Hi @Nikolassss 

Thanks for posting in our business forum.

Nikolassss wrote

Hello @Clive_A, Thank you for your reply.

Correct, The VPN setup is using WireGuard, and it has been working well to allow device from HQ to communicate with device in Branch Office and vice versa. This was set up using the allowed IPs as you mentioned.

My current problem is: I want to have some device to only able to access internal network (a.k.a block access to internet to some device only). BUT, when I set the ACL rule to dny the IP group access to the WAN, it also deny access to other devices on the other site (HQ to Branch and vice versa)

 

 

The desired output I'm looking for is: The devices that has it's access blocked to the WAN, can still communicate with devices BOTH on local network, and on the remote network that is connected through Wireguard VPN.

Please give me some guidance, and any help would be appreciated.

Thank you,
Nikolas

Block Internet access, so you are currently using the 0.0.0.0/0 as the allowed IP on one of the sites now, correct?

If that's the case, then you are routed to the peer site and use the remote gateway as the default gateway. If you stop accessing the Internet, it might cause a problem with the WG connection.

I think you might wanna try the allowed IP.

ACL might not be helpful in this situation because of the following concerns:

1. It might not be effective for the VPN.

2. IP Group or GW ACL in the controller mode is currently limited. You can only specify the CIDR instead of the range like from A to B. (But you can still manually specify these IPs). It might be hard to satisfy what you need to achieve.

As for the WG now, if you set it on the router, it's hard to specify the rules for it. I think it might not be possible to achieve what you asked at this moment.

Hi @Nikolassss 

Thanks for posting in our business forum.

Nikolassss wrote

Clive_A wrote

Hi @Nikolassss 

Thanks for posting in our business forum.

Nikolassss wrote

Hello @Clive_A, Thank you for your reply.

Correct, The VPN setup is using WireGuard, and it has been working well to allow device from HQ to communicate with device in Branch Office and vice versa. This was set up using the allowed IPs as you mentioned.

My current problem is: I want to have some device to only able to access internal network (a.k.a block access to internet to some device only). BUT, when I set the ACL rule to dny the IP group access to the WAN, it also deny access to other devices on the other site (HQ to Branch and vice versa)

 

 

The desired output I'm looking for is: The devices that has it's access blocked to the WAN, can still communicate with devices BOTH on local network, and on the remote network that is connected through Wireguard VPN.

Please give me some guidance, and any help would be appreciated.

Thank you,
Nikolas

Block Internet access, so you are currently using the 0.0.0.0/0 as the allowed IP on one of the sites now, correct?

 

If that's the case, then you are routed to the peer site and use the remote gateway as the default gateway. If you stop accessing the Internet, it might cause a problem with the WG connection.

I think you might wanna try the allowed IP.

 

ACL might not be helpful in this situation because of the following concerns:

1. It might not be effective for the VPN.

2. IP Group or GW ACL in the controller mode is currently limited. You can only specify the CIDR instead of the range like from A to B. (But you can still manually specify these IPs). It might be hard to satisfy what you need to achieve.

As for the WG now, if you set it on the router, it's hard to specify the rules for it. I think it might not be possible to achieve what you asked at this moment.

  @Clive_A Not exactly. My WG is setup to only tunnel certain IP using the allowed IP parameter. Which should mean the default gateway is still the one local to the site.

With my logic, if I can deny access using ACL to 0.0.0.0/0 EXCEPT for a certain allowed IP on the remote site, I should be able to achieve what I need. But I am not sure how to do that. Is there any way to do that with ACL?

I don't think the ACL would be useful in this case.

I don't understand the use case then if you say so in the highlighted part. You want to block Internet access for some devices that could access the remote site?

Can you explain with a diagram?