Guest Network with access to Photos App

[guybor]

I have a "weird" scenario that I'm wondering if it will work.

We have an iPad that only has access to the guest network so that it stays isolated from the rest of the network. BUT...with the new Photos App in DSM7, I would like to allow it to upload photos to the Synology which is on the main network....and isolated from the iPad.

Is there a way to only allow the photos app access from the iPad while still keeping the rest of the surfing etc isolated?

Thank you in advance.
Guy

 

[fredbert]

Probably this will depend on what your firewall supports for managing the separation of VLANs.

Using a bespoke HTTPS TCP port for the Photos package might work. Then modify your firewall to permit routing and firewall policy to this destination port from the guest LAN.

 

[guybor]

I'm using the Unifi infrastructure...USG and controller.

I'll look into changing the port and poking a hole in the firewall.

 

[Gerard]

Set Static ip for the iPad, then firewall rule to allow the iPad ip access to lan

 

[Robbie]

First, get rid of the UniFi 'Guest Network' feature and set your own corporate VLAN for guest/untrusted devices:

Second:

Set Static ip for the iPad, then firewall rule to allow the iPad ip access to lan...

...IP of the NAS only.

I do something similar to allow my guests access to the printer/scanner on my main network but deny everything else:

If you want to use more Apple-like features on the iPad that use things like mDNS / Bonjour across VLANs then you will need to have suitable rules to cover that too:

 

[Gerard]

Second:

Gerard said:
Set Static ip for the iPad, then firewall rule to allow the iPad ip access to lan...

...IP of the NAS only.

correct NAS only (not lan)