YazFi Can YazFi custom firewall rules overcome VLAN client isolation?

[Waylo]

I have my IOT devices isolated on a VLAN using YazFi. Client isolation is ON for this network.

On occasion, I will encounter a device that requires client isolation to be turned off when adding it. I believe it's because the device needs direct access to the phone app and vice versa.

I could turn off client isolation, add the device, and then turn it back on.

But can I accomplish something similar via a custom firewall rule?

GitHub - jackyaz/YazFi: Feature expansion of guest WiFi networks on AsusWRT-Merlin, including SSID -> VPN, separate subnets per guest network, pinhole access to LAN resources (e.g. DNS) and more!

Feature expansion of guest WiFi networks on AsusWRT-Merlin, including SSID -> VPN, separate subnets per guest network, pinhole access to LAN resources (e.g. DNS) and more! - jackyaz/YazFi

github.com

Can I use rules to open up my phone only, on the IOT wifi, to access any other IOT device on the same client isolated network? And vice versa, allow any IOT device to access my phone's IP address?

Or, less broad, open up 2 way contact between my phone and 1 other single address on the IOT wifi?

I've done this across VLANs to great effect. But my attempts to do this with firewall rules within the IOT VLAN don't seem to work. I wonder if the client isolation setting supersedes some custom firewall commands, or (probably more likely) if I'm just not configuring the IPtable line correctly.

Some sample lines I've tried, with wl0.2 the IOT wifi VLAN and 192.168.3.144 the phone's IP address:

iptables -I YazFiFORWARD -i wl0.2 -o wl0.2 -s 192.168.3.144 -j ACCEPT
iptables -I YazFiFORWARD -i wl0.2 -o wl0.2 -d 192.168.3.144 -j ACCEPT

 

[bennor]

What router and firmware are you using? If using the router and firmware listed in your signature line, note that the 386.7.0 is extremely old firmware (from 22-June-2022). 3004.388.8_4 is the latest Asus-Merlin firmware.

You may need to use specific IP addresses for both the source and destination. Maybe something like the following in the script file:

#!/bin/sh
iptables -I YazFiFORWARD -i wl0.1 -o wl0.1 -s 192.168.3.50 -d 192.168.3.100 -j ACCEPT
iptables -I YazFiFORWARD -i wl0.1 -o wl0.1 -s 192.168.3.100 -d 192.168.3.50 -j ACCEPT

Don't recall anyone trying to circumvent Client Isolation within the same YazFi Guest Network using custom firewall rules scripting. Rather its usually trying to either block internet access to YazFi clients or allow traffic between a specific YazFi client and the main LAN.

Don't have a way to check at the moment if the example above works as I don't currently run Asus-Merlin on my RT-AX86U Pro at the moment.

 

[Waylo]

Thanks for the reply.

I did try similar code to what you posted in my own earlier testing but I don't believe it worked, hence my reporting here to see if anyone had tried to circumvent the client isolation. It was slightly tricky because one presumes the devices will be assigned the same IP addresses upon logging in. But maybe it's worth more testing before I make declarations.

(Yes, I am still on this older firmware and there are probably several security fixes between then and the present. I'm just hesitant I will run into some bug upon upgrading).

 

[bennor]

(Yes, I am still on this older firmware and there are probably several security fixes between then and the present. I'm just hesitant I will run into some bug upon upgrading).

Your hesitation or fear of a bug or issue with updating the firmware should not stop you from updating to the latest firmware, if for no other reason than security vulnerability patches including the most resent one involving the malware vector in the Asus AiCloud / AsusDisk feature.

Malware damaging ASUS routers?

This malware damaging Asus routers has to be described in a sticky thread with a warning sign! Update: Asus is releasing patched firmware for multiple models. Check for firmware updates! The changelog for most firmware releases contains the following: 1. Strengthened input validation and data...

www.snbforums.com

When using YazFi, one can assign manual IP addresses to YazFi clients so they always receive the same IP address each time they connect to the YazFi Guest Network. See the following links for more on YazFi client manual IP reservations.
https://github.com/jackyaz/YazFi/wi...verse-DNS-records#a-note-on-dhcp-reservations
https://www.snbforums.com/threads/y...inc-ssid-vpn-client.45924/page-32#post-473403