NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Solved
SXK80: Allow Specific Client/s across VLAN
I have the SXK80 for my home since I really wanted the VLAN feature set and especially network isolation between my main LAN and IoT. I know in the settings I can disable network isolation comple...
BruceGuo it's actually pretty amazing. From my tests, I can keep network isolation on for the source vlan and access still works. Further, the gateway is doing single direction resolution. In the past, I've tried to use the avahi gateway but ran into issues with it essentially echoing back to hosts their own name which causes Apple produces to change their name to "some device (123)" and on macOS display a dialogue about the name being taken. This resolves that.
So, it looks like the gateway is discovering devices according to the Shared Service Type, creates iptables prererouting/redirect rules, and then relaying the broadcast? This is far better than what was done before and I'm impressed.
The only thing I'd ask to change is that the dropdown for services is someone restrictive. AFP is dying, AirPlay and Chromecast are good as are scanners and printing, but there should be a middle ground before hitting "All Services". For example, HomeKit is missing which is probably the second most used behind AirPlay/Chromecast. I would suggest giving people a custom option to add something like "_scanner._tcp", "_sonos._tcp", or whatever else.
Anyways, tomorrow I'll finally move my IoT devices off to their own VLAN and begin long term testing.
Once again, great work and thanks BruceGuo
We hope you to report problem before we officially release it.
BruceGuo it's actually pretty amazing. From my tests, I can keep network isolation on for the source vlan and access still works. Further, the gateway is doing single direction resolution. In the past, I've tried to use the avahi gateway but ran into issues with it essentially echoing back to hosts their own name which causes Apple produces to change their name to "some device (123)" and on macOS display a dialogue about the name being taken. This resolves that.
So, it looks like the gateway is discovering devices according to the Shared Service Type, creates iptables prererouting/redirect rules, and then relaying the broadcast? This is far better than what was done before and I'm impressed.
The only thing I'd ask to change is that the dropdown for services is someone restrictive. AFP is dying, AirPlay and Chromecast are good as are scanners and printing, but there should be a middle ground before hitting "All Services". For example, HomeKit is missing which is probably the second most used behind AirPlay/Chromecast. I would suggest giving people a custom option to add something like "_scanner._tcp", "_sonos._tcp", or whatever else.
Anyways, tomorrow I'll finally move my IoT devices off to their own VLAN and begin long term testing.
Once again, great work and thanks BruceGuo
I also wanted to have the ability to use my phone to connect to IoT devices so I installed the beta firmware V4.2.1.106 on my SXR30/SXS30 and it seems to work. The exact steps to enable it were a bit hard to figure out though.
My network setup:
- 1(Default)
- Desktop PC
- 20(Employee) - Network Isolation
- 30(Iot) - Network Isolation. I previously had Client Isolation on, but it prevents this feature from working. Makes sense.
- Chromecast Ultra
- LG WebOS TV
- 40(Guest) - Client & Network Isolation
- 10(Personal) - Network Isolation
- Android Phone
So In the web interface > Advanced > Advanced Setup > mDNS Gateway, I enabled mDNS Gateway and added the following policies:
- Policy 1, All Services, Source VLAN 1, Destination VLAN 30
- Policy 2, Chromecast, Source VLAN 30, Destination VLAN 1
- Policy 3, All Services, Source VLAN 10, Destination VLAN 30
- Policy 4, Chromecast, Source VLAN 30, Destination VLAN 10
I don't know if all of these policies were necessary, but rebooting the router and the devices takes a very long time to test so I didn't mess around too much with it.
Going with this configuration and rebooting the router and the Chromecast, reconnecting etc., now my phone and desktop PC are able to cast to the Chromecast. My LG ThinQ app on my phone can't connect to the TV, but I guess that is not supported. If this is possible in the future, I would appreciate it. I tried pinging devices from across each VLAN and they seem to be isolated properly on the network.
My only feedback, was that it was hard to get working without knowing what I should do. At one point I thought I had to disable network isolation on the Iot network to get it working, and that I needed another VLAN to separate my devices since 1(Default) does not have network isolation. Also it would be nice if the mDNS Gateway page would populate itself with devices it detected on the network (not sure if this is possible) so you can just enable a policy rather than writing it yourself.
- 1(Default)
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
