Prevent guest on wifi to emby server

[t123thomas 63]

Hi if anyone can assist, my emby server is on subnet 192.168.1.1/24,

In my DDWRT router I have a separated the guest by diff bridge  br1  subnet (192.168.2.1/24)

I have test every possible connections to determine that guest access is limited to 192.168.2.1, it works except for emby server which on 192.168.1.105:8096

Any thoughts on how to prevent guest from accessing emby on subnet 192.168.1.1/24 port 8096.

 

 

Edited March 5, 2023 by t123thomas

[GrimReaper 4749]

Have you tried forcing only 192.168.1.1/24 subnet as local and then Blacklist filtering subnet 192.168.2.1/24 as remote? 

[Happy2Play 9783]

Was just typing that.

Or Firewall changing local scope.

[Darkseidd 59]

simple firewall rule could achieve this

[rbjtech 5284]

Err... the entire point of a 'Guest' network is for them to NOT have access to any other local LAN network.

You appear to be doing this the wrong way around.

You should block everything (by default, no need for a firewall - the two networks should not be 'bridged') - and then use the 'firewall' as a 'router' to cross the networks.

ie if you just enable a f/w rule from 192.168.2.0/24 (ie all the Guest Network) to 192.168.1.x (emby server IP) on port 8096 - then they can connect to emby (and ONLY emby - nothing else).

If you did want to just bridge the networks (for some reason, maybe you just want it for a separate AP? ) - then a simply f/w rule to drop traffic from the Guest source network (192.168.2.0/24) to the emby IP destination is also a way to achieve this - as said above.  Make sure this appears before any other rules.

Edited March 5, 2023 by rbjtech

[t123thomas 63]

7 hours ago, rbjtech said:

Err... the entire point of a 'Guest' network is for them to NOT have access to any other local LAN network.

You appear to be doing this the wrong way around.

You should block everything (by default, no need for a firewall - the two networks should not be 'bridged') - and then use the 'firewall' as a 'router' to cross the networks.

ie if you just enable a f/w rule from 192.168.2.0/24 (ie all the Guest Network) to 192.168.1.x (emby server IP) on port 8096 - then they can connect to emby (and ONLY emby - nothing else).

If you did want to just bridge the networks (for some reason, maybe you just want it for a separate AP? ) - then a simply f/w rule to drop traffic from the Guest source network (192.168.2.0/24) to the emby IP destination is also a way to achieve this - as said above.  Make sure this appears before any other rules.

Thanks for your thought, I am no expert in iptable fire chain, I have search various sites on this subject if I will get a scripts but no luck.

My router firmware is ddwrt appreciate if someone's can write the iptable rules that prevent the guest 192.168.2.1/24 from 192.168.1.1/24 while the guest can access internet.

Thanks

[Happy2Play 9783]

Does your guest network have "Wireless Isolation" option?  Could have may other isolation names though.

[t123thomas 63]

1 hour ago, Happy2Play said:

Does your guest network have "Wireless Isolation" option?  Could have may other isolation names though.

Yes 

[t123thomas 63]

2 hours ago, t123thomas said:

Yes 

Here is my Iptable rules, what seem to be the issue is the forward rules, when I removed it local guest was not able able to access emby

However, I the the portforward rules are needed  for external  client to access emby server

Any idea on how to rewrite the rules? Otherwise I will use emby blacklist rules

 

iptables -I FORWARD -i br0 -o br1 -j ACCEPT

iptables -I FORWARD -i br1 -o br0 -m state --state RELATED.ESTABLISED -j ACCEPT

iptables -I FORWARD -i br1 -o br0 -j DROP

 

ext_port=8096

int_port=8096

int_ip=192.168.1.104

iptables -t nat -I PREROUTING -p tcp -d $(nvram get oet1_ipaddr) --dport $ext_port -j DNAT --to $int_ip:$int_port

iptables -I FORWARD -p tcp -d $int_ip --dport $int_port -j ACCEPT

 

 

 

 

 

Edited March 5, 2023 by t123thomas

[rbjtech 5284]

8 hours ago, t123thomas said:

Here is my Iptable rules, what seem to be the issue is the forward rules, when I removed it local guest was not able able to access emby

However, I the the portforward rules are needed  for external  client to access emby server

Any idea on how to rewrite the rules? Otherwise I will use emby blacklist rules

 

iptables -I FORWARD -i br0 -o br1 -j ACCEPT

iptables -I FORWARD -i br1 -o br0 -m state --state RELATED.ESTABLISED -j ACCEPT

iptables -I FORWARD -i br1 -o br0 -j DROP

 

ext_port=8096

int_port=8096

int_ip=192.168.1.104

iptables -t nat -I PREROUTING -p tcp -d $(nvram get oet1_ipaddr) --dport $ext_port -j DNAT --to $int_ip:$int_port

iptables -I FORWARD -p tcp -d $int_ip --dport $int_port -j ACCEPT

 

 

 

 

 

You may need to ask on the ddwrt forums - this is a networking/ddwrt issue rather than an Emby issue.

[Happy2Play 9783]

Doesn't Guest network Wireless Isolation accomplish this?

[t123thomas 63]

I have resolve the issue through emby blacklist I prefer this approach its easy to isolate specific IP or and subnet.

The iptable works fine, the issue because is I opened internal and external port forward which allows guest into emby once I removed the port forward guest are completely isolated.

Edited March 10, 2023 by t123thomas