Setting up IoT networks using 3006 firmware?

[XIII]

If I understand the new 3006 IoT networks correctly:

• when using the same VLAN as the main network, devices on the main network (PCs, phones, tablets) can see IoT devices (and vice versa)
• when using a different VLAN than the main network, devices on the main network cannot see IoT devices (and vice versa)

Is there also an easy way to let devices on the main network see IoT devices, but let IoT devices not see devices on the main network?

Or even a layered setup:

1. Main network (PCs, phones, tablets); can see devices in layers 1, 2, and 3
2. IoT "orchestrators" (HomeKit hub, Homey, etc.); can see devices in layers 2 and 3
3. IoT sensors/actuators (smart bulbs, smart plugs, temperature sensors, etc.; can see devices in layer 3 (or even not devices in layer 3)

How to do this using the 3006 firmware?

 

[OzarkEdge]

How to do this using the 3006 firmware?

Good question... I setup a custom 2.4 IoT VLAN (3 Wyze cams, 2 on MoCA2.5 wired node) and stopped to wait for the next VLAN release.

My non-default custom 2.4 IoT VLAN settings:
WPA2/WPA3-Personal
Access Intranet disabled
DHCP Server enabled (192.168.53.*)
VID 53
AP Isolated enabled
on all nodes

I eventually want to include some node LAN ports but not sure if the VLAN will work across my MoCA uplink(?)

Ping from Windows desktop on LAN to a cam IP address times out, no response.

Wyze app on mobile on main WLAN can access cams on IoT VLAN, but I believe this is by way of the Internet/Wyze cloud.

OE

 

[bennor]

Is there also an easy way to let devices on the main network see IoT devices, but let IoT devices not see devices on the main network?

There are several past discussions on trying to emulate YazFi's one way to guest under the 3006 firmware (likely requiring the use of IPTables entries) with mixed success:
https://www.snbforums.com/threads/yazfi-lite-with-router-in-ap-mode.75121/page-3#post-948055

Allowing main network to access guest networks

Hi everyone, Running on the 3006 firmware version, I have 3 guest networks that are isolated from everything. I'd like to have the main network (192.168.0.0/24 on br0) be able to reach one-way to those 3 guest subnets. I currently achieve this with a firewall-start script that runs the...

www.snbforums.com

YazFi - Allowing cast traffic from guest network to IoT (media) network

Hi, new to AsusWRT-Merlin and YazFi! (Not to mention iptables.) I'm trying to allow my "true" guest network (wl0.1, wl1.1) one-way access to my "media" guest network (wl0.2, wl1.2). The intent being to allow house guests to be able to cast music/video to my speakers/TV. Per Google's help page...

www.snbforums.com

Edit to add: Another discussion referencing a firewall-start script file.

https://www.snbforums.com/threads/r...l-while-access-intranet-set-to-disable.77461/

Edit to add2:
Probably something like the following in a firewall-start script file with the GN/VLAN IP subnet examples 52, 53, 54:

#!/bin/sh
iptables -I FORWARD -i br0 -s 192.168.0.0/24 -d 192.168.52.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -s 192.168.0.0/24 -d 192.168.53.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -s 192.168.0.0/24 -d 192.168.54.0/24 -j ACCEPT

Not running the Asus-Merlin 3006 alpha on my RT-AX86U Pro so cannot test. Waiting for the Asus-Merlin beta firmware.

 

[XIII]

Probably something like the following in a firewall-start script file with the GN/VLAN IP subnet examples 52, 53, 54

Thanks.

Might experiment with that some day, but I first want to see whether the current setup (IoT on same VLAN as main network) is finally stable.

 

[Gary_Dexter]

Have also asked on several posts as well.

GT-AC2900 is having issues and want to replace, maybe with an AX-88u Pro, if I can get the same “1-way to guest” working, ideally without much script-tinkering.

Otherwise, I may have to jump ship to UniFi or Synology.