Controllerless Networks

last person joined: yesterday 

Instant Mode - the controllerless Wi-Fi solution that's easy to set up, is loaded with security and smarts, and won't break your budget
Back to discussions
Expand all | Collapse all

Instant firewall rules blocking DNS even though it is allowed

This thread has been viewed 1 times

  • 1.  Instant firewall rules blocking DNS even though it is allowed

    EMPLOYEE
    Posted Jan 17, 2014 03:29 PM

    Hi,

     

    I had a situation with some instants where the DNS requests were blocked, even though I had explicitly allowed them.  It is for guest traffic, that is using a corp DNS on 192.168.0.0 network.

     

    The rules were as such,

     

    svc-dhcp any allow
svc-dns any allow
any network 192.168.0.0/16 deny
any any permit

     No response from the DNS server on 192.168.100.250.  Unless I've misunderstood the firewall rule, this should have worked?

     

    The clients are also on a 192.168.154.0 subnet as well, so maybe that has something to do with it.



  • 2.  RE: Instant firewall rules blocking DNS even though it is allowed

    Posted Jan 17, 2014 11:40 PM

    Is that an instant rule?

    instant aps rules looks more like this

     

    wlan access-rule Casa 
index 2 
rule any any match any any any permit log

     

    That looks more like a Controller firewall rule what you got in there though or did you type it like that because it was easier for the forum users to read?

     

    Cheers

    Carlos



  • 3.  RE: Instant firewall rules blocking DNS even though it is allowed

    EMPLOYEE
    Posted Jan 18, 2014 05:58 AM

    Carlos, actually it is for Instants, but I was writing the rule off the top of my head.  The actual rules are

     

    rule any any match udp 67 68 permit
rule any any match udp 53 53 permit
rule 192.168.0.0 255.255.0.0 match any any any deny
rule any any match any any any permit

     but even if I put 'rule 192.168.101.250 255.255.255.255 match any any any permit' above the deny rule, it still doesn't get DNS.

     

    AP225s version 4.0.0.1