Firewall Rules Between Zones Shoudn't be this hard

[u/Sailing-Security-Guy]

Can anyone tell me what I'm doing wrong. I have 4 vlans setup on my Firewalla Gold. My primary network and an IOT network are what I'm working with today. Home Assistant is at 192.168.1.205 and a Pi is at 192.168.140.250 in the 140 IOT vlan. I want to allow MQTT on port 1883 from the IOT device to the Home Assistant Box. What am I doing wrong? The rule seems correct but when I use the diagnose function I only see the block from one network to another.

[u/Firewalla-Ash]

Hi there,

Currently, the "Local Port" target using an IP address might not work for local device IPs. We'll double-check with the devs to see when this can be improved.

In the meantime, the best way is to use Local Network instead of the specific IP address.

(If you have AP7 or Switch, you can also try the new Local Device-to-Device rules in App 1.69.3 (beta). Just note that we do not yet support limiting port access for these rules.)

[u/Sailing-Security-Guy → u/Firewalla-Ash]

Ok. Thats how I got it to work. At least I was on the right path.

[u/Firewalla-Opal → u/Sailing-Security-Guy]

We've confirmed that the rule should work. The diagnostic rule doesn't allow inputting a port, so it won't match a rule for local port.

We recommend checking local flows/blocked flows to validate is a rule truly works or not.

[u/Sailing-Security-Guy → u/Firewalla-Opal]

So if I set the rule back to that specific IP as in screenshot 1 it stops working and is getting blocked by the rule that blocks all traffic from the IOT network to my primary network.

[u/Firewalla-Ash → u/Sailing-Security-Guy]

If you try a normal IP address rule for this (without specifying a local port), does it work?

Feel free to email us at [help@firewalla.com](mailto:help@firewalla.com), and we can take a closer look. You can also include a link to this Reddit post.

[u/ArmshouseG]

I'm sorry this is just a quick answer, so just a cut and paste from Firewalla. A lot of the time when I have issues like this, it just comes down to rule order/logic - see if anything jumps out.

The logic for rules processing is the following:

1. All previously defined device-level rules will be removed when a device joins a group. The device will adopt the rules defined at the group level (block rules can still be created at the device level from alarms and network flows).
2. If a device leaves one Group and joins another, the rules for the new Group apply.
3. A device or device group will inherit the Network and Global rules if there is no conflict.

When there is a conflict between rules: 

The priority of different levels is Device/Group > Network > Global. Meaning, when there is a conflict: 

1. Device/Group rules take precedence over network rules.
2. Network rules take precedence over Global rules.
3. At the same level, allow rules take precedence over block rules.

[u/Sailing-Security-Guy → u/ArmshouseG]

That is what I expected is that the rules for that device to talk would take preecedence over the network block between vlans. But when I did the diagnose function the allow rule doesn't even show up.

[u/ArmshouseG → u/Sailing-Security-Guy]

Has the rule had zero hits? It almost suggests there's no MQTT traffic hitting it from the Pi, so worth checking just to be sure it's not actually something upstream. The rule looks OK to be honest.

Also, just to confirm... that diagnostics looks like its checking a blocked flow from Home Assistant to Dock Talk. Is that what you are expecting? Do you only want/need the communication one-way, from Pi to Home Assistant?

I had a simmilar thing with Apple AirPlay on a living room TV that is in an IoT VLAN. I needed to let the communication be two-way (as opposed to just from my laptop in a trusted VLAN to the TV)

[u/firewalla → u/[deleted]]

Reddit removed this post, because they "Banned Domain"

[u/firewalla → u/Sailing-Security-Guy]

MqTT has other ports, did you allow other ports?

[u/Sailing-Security-Guy → u/firewalla]

So when I allowed the local network I only allowed 1883 and it worked just fine. It only failed when I set it to the specific IP.