topic Re: Firewall access rules conf and IGMP proxy in Network Security

Firewall access rules conf and IGMP proxy

Alex Johnson — Fri, 21 Feb 2020 16:44:39 GMT

Hello,

On my cisco router ( model RV340W ) I have a TV decoder from my internet service provider. It is connected on my cisco router ( LAN4/VLAN3 ). Itself ( cisco router ) connected to my internet service provider router ( by WAN1 and WAN 2 ).

Configuration of vlan3 and wan2 adress attribution : dhcp

Routing parameters : IGMP proxy -> upstream WAN2 -> downstream Vlan3

The Vlan3/Wan2 are only dedicated to the IP multicast ( TV flux ).

All works perfectly. I wanna apply a firewall access rules to denied acces into Vlan3 and WAN2 at some hours by day to cut the TV flux. Problem, the rules don't work.

I choose to denied : VLAN3 -> WAN2 ( service : all traffic, source and destination : all, time : alway, rules : enabled ).

Same rules to : WAN2 -> VLAN3

Can you explain, why the acces rules don't work? ( TV flux is never cut ) and how fix that if its possible plz?

Regards,

Rei

Re: Firewall access rules conf and IGMP proxy

Marius Gunnerud — Sun, 03 Feb 2019 19:55:00 GMT

Could you post the ACL configuration you are tyring to implement? I am assuming that this is being configured on the router and not on an actual firewall?

Re: Firewall access rules conf and IGMP proxy

Marius Gunnerud — Sun, 03 Feb 2019 20:28:29 GMT

Just noticed that you are using RV340W.

I choose to denied : VLAN3 -> WAN2 ( service : all traffic, source and destination : all, time : alway, rules : enabled )

You have set the time to Always. You need to change this to your desired time range.

1. Go to System Configuration > Schedule and click Add Enter a meaningful name, the desired time range and days the rule should apply to.

2. Go to Firewall > Access Rules and either edit an existing rule or add a new rule. Under Scheduling > Schedule Name select the name you just created and apply the changes.

Re: Firewall access rules conf and IGMP proxy

Alex Johnson — Mon, 04 Feb 2019 14:03:15 GMT

Firstly, thanks for your help Marius Gunnerud, really appreciated.

I have make some acces rules with some schedules examples :

VLAN3 -> WAN2 ( denied service : all traffic, source and destination : all, time : morning rules : enabled ) ( morning = 10:30AM/12:00AM )

VLAN3 -> WAN2 ( denied service : all traffic, source and destination : all, time : afternoon rules : enabled ) ( afternoon = 14:30PM/16:30PM )

VLAN3 -> WAN2 ( denied service : all traffic, source and destination : all, time : evening rules : enabled ) ( evening = 19:30PM/21:30PM )

But for unknow reason, the TV decoder is always active and transmit flux at the TV.

Re: Firewall access rules conf and IGMP proxy

Marius Gunnerud — Mon, 04 Feb 2019 14:08:47 GMT

Is by any chance the IP address of the TV decoder part of the subnets configured for all three rules?

Re: Firewall access rules conf and IGMP proxy

Alex Johnson — Mon, 04 Feb 2019 14:59:51 GMT

The IP adress of the TV decoder is an integral part of VLAN3. ( checked on ARP table ) exemple :

- TV decoder IP : 194.168.4.xxx --> MAC : xx:xx:xx:xx..... --> VLAN3

I hope, I understood the meaning of your question?

Re: Firewall access rules conf and IGMP proxy

Marius Gunnerud — Mon, 04 Feb 2019 15:18:25 GMT

What I am trying to get at is if the TV decoder IP is part of the VLAN3 subnet, and you are defining the whole VLAN3 subnet in the access rule, then the TV3 decoder will always be matched. You would need to add an access rule above the three existing rules specifically for the TV decoder that denies the traffic during the required timeframe.

Re: Firewall access rules conf and IGMP proxy

Alex Johnson — Mon, 04 Feb 2019 18:32:43 GMT

When you say "add an access rule above the three existing rules" this rules is ok for you?

192.168.4.xxx -> ANY ( denied service : all traffic, source and destination : all, time : always rules : enabled )

( replaced WAN2 by ANY and VLAN3 by TV decodeur IP and time : always above my 3 rules)?

Otherwise, no, I do not understand. Can you send me an example plz?

Re: Firewall access rules conf and IGMP proxy

Marius Gunnerud — Tue, 05 Feb 2019 22:14:31 GMT

That rule has time: always which is not what you are after...or is it?

in any case, I suggest placing the rule at the top of the list. There are buttons on the left that say up and down, click up until the rule is at the top of the list.

Re: Firewall access rules conf and IGMP proxy

Alex Johnson — Wed, 06 Feb 2019 13:24:24 GMT

The problem, I have try a rules to block all packets.

( All port, all stuff crossing the router, anytime in first position of rules ect .... ).

With this rules all my stuff : computer, wifi, smartphone are blocked but the TV decoder no. It is always active.

Re: Firewall access rules conf and IGMP proxy

Marius Gunnerud — Sun, 10 Feb 2019 17:39:39 GMT

it is possible the router is not able to match on the traffic type from the TV decoder. That is if there is not an issue with the cabling in your network.

Re: Firewall access rules conf and IGMP proxy

Alex Johnson — Mon, 11 Feb 2019 16:04:00 GMT

Hmm. The TV flux use RTP protocol. Its a bit strange but maybe...

Re: Firewall access rules conf and IGMP proxy

krishna_c — Thu, 21 Feb 2019 10:48:08 GMT

Hey, RTP protocol over unicast or multicast IP?

Re: Firewall access rules conf and IGMP proxy

Alex Johnson — Tue, 26 Feb 2019 12:16:16 GMT

If I believe the technical specifications of the TV decoder, multicast IP.

Re: Firewall access rules conf and IGMP proxy

Alex Johnson — Tue, 26 Feb 2019 12:20:29 GMT

Hmmm. You wanna say, I try to connect tv decoder ( VLAN4 ) to my internet service provider ( WAN 2 ) only with static routing rules? and without igmpproxy?