Instant firewall rules blocking DNS even though it is allowed

[Michael_Clarke]

Hi,

I had a situation with some instants where the DNS requests were blocked, even though I had explicitly allowed them.  It is for guest traffic, that is using a corp DNS on 192.168.0.0 network.

The rules were as such,

svc-dhcp any allow
svc-dns any allow
any network 192.168.0.0/16 deny
any any permit

 No response from the DNS server on 192.168.100.250.  Unless I've misunderstood the firewall rule, this should have worked?

The clients are also on a 192.168.154.0 subnet as well, so maybe that has something to do with it.

[cdelarosa]

Is that an instant rule?

instant aps rules looks more like this

wlan access-rule Casa 
index 2 
rule any any match any any any permit log

That looks more like a Controller firewall rule what you got in there though or did you type it like that because it was easier for the forum users to read?

Cheers

Carlos

[Michael_Clarke]

Carlos, actually it is for Instants, but I was writing the rule off the top of my head.  The actual rules are

rule any any match udp 67 68 permit
rule any any match udp 53 53 permit
rule 192.168.0.0 255.255.0.0 match any any any deny
rule any any match any any any permit

 but even if I put 'rule 192.168.101.250 255.255.255.255 match any any any permit' above the deny rule, it still doesn't get DNS.

AP225s version 4.0.0.1