search

mjp66 / Ubiquiti

760 stars 70 forks source link

NAT Hairpin/reflection/loopback rules #14

Closed jradwan closed 6 years ago

jradwan commented 6 years ago

Excellent guide (got here via Security Now as I'm sure a lot of people did).

One thing I have been wrestling with is NAT hairpinning and the related firewall rules on the ER-X. I would like devices on my Wifi Guest Net to be able to access services on the Home Wired Network (like Plex, or a web site which are available via the WAN IP and port forwarding).

I have the VLAN isolation working for my WiFi IoT Net and Wifi Guest Net, and the LOCAL rules (for DNS/DHCP) on those networks works as well. But a device connected to the Guest wifi cannot connect to services on the wired home network.

Could you possibly add a section relating to hairpinning?

Thanks!

mjp66 commented 6 years ago

You might look at issue #9 (disable AP guest policy) and https://help.ubnt.com/hc/en-us/articles/204952134-EdgeRouter-NAT-Hairpin-Nat-Inside-to-Inside-Loopback-Reflection- -Mike

jradwan commented 6 years ago

I'm not using the Guest Policy on my Unifi AP and I AM using the hairpin checkboxes in the GUI (running 1.10.0 now). I feel like sometimes the documentation on Ubiquiti's site is old and not updated and never sure if it still applies. For example, that doc you referenced (which I've seen) seems like it's for pre-1.4.0 configs before they added the hairpin checkbox to the GUI.

I'll keep poking at it ... thanks.