I am trying to configure a secondary network for my IOT stuff. I want to allow only a few device internet access and the rest should be "jailed" to that network. Also, all devices on the IOT network should be able to access my MQTT server that is on my main network.
My setup is as follows:
- Firmware: DD-WRT v3.0-r34015M kongac (12/09/17) - More recent versions give me a lot of trouble with wireless connectivity. Wifi keeps dropping off after 10 minutes and the only way to fix it is to restart the router.
- Hardware: Netgear R7000
My network is configured such that:
Under Wireless -> Basic Settings:
- I've added a VAP
- Network Config: Bridged
- AP Isolation: Disable
Under Setup -> VLANs
- Port 2 = VLAN15 (no bridge assignment)
Under Setup -> Networking
- Added new bridge (br2)
- Assigned wl02 and vlan15 to br2
- Assigned 192.168.7.0/24 to br2
- Added DHCP server for br2
Under Setup -> Advanced Routing
- Added a route from 192.168.1.0/24 to 192.168.7.0/24 via br2
If I do not add any firewall rules, I am able to access devices on my IOT network from main network and, if I were to connect to my IOT network, I can browse the web.
After doing some searching, I added theses firewall rules (it seems like dd-wrt is always prepending the rules, so DROP needs to be entered first):
iptables -I FORWARD -i br2 -j DROP iptables -I FORWARD -i br2 -o br0 -d 192.168.1.38 -p tcp --dport 1883 -m state --state NEW -j ACCEPT iptables -I FORWARD -i br0 -o br2 -m state --state NEW -j ACCEPT
As a result,
- IOT -> Internet = DENIED
- Main -> IOT = DENIED
- IOT -> 192.168.1.38:1883 = DENIED
I am sure that I am missing something with iptables, but not sure what.
Also, is it safe to assume that adding:
iptables -I FORWARD -i br2 -o br0 -s 192.168.7.5 -m state --state NEW -j ACCEPT
will allow 192.168.7.5 access the internet?
Any guidance is greatly appreciated.
Update: Output of requested commands (with redacted WAN IP):
root@DD-WRT:~# ip -br link root@DD-WRT:~# ip -4 -br address root@DD-WRT:~# ip route default via 220.127.116.11 dev vlan2 X.X.X.X/23 dev vlan2 proto kernel scope link src X.X.X.X 127.0.0.0/8 dev lo scope link 169.254.0.0/16 dev br0 proto kernel scope link src 169.254.255.1 172.16.0.0/24 via 172.16.0.1 dev vlan3 172.16.0.0/24 dev vlan3 proto kernel scope link src 172.16.0.3 192.168.1.0/24 via 192.168.1.1 dev br0 scope link 192.168.1.0/24 dev br0 proto kernel scope link src 192.168.1.1 192.168.7.0/24 via 192.168.7.1 dev br2 scope link 192.168.7.0/24 dev br2 proto kernel scope link src 192.168.7.1 192.168.15.0/24 dev br1 proto kernel scope link src 192.168.15.1 root@DD-WRT:~# ip rule 0: from all lookup local 32766: from all lookup main 32767: from all lookup default