DSM 7.1 [RT6600ax] Unable to reach internal NAS or printer or IoT devices

[SynFan]

Hi,

I am having issues accessing internal devices over VPN. I have four VLAN's on my RT6600ax router

1. Primary Network - Personal Laptops, phones and NAS. Disabled AP isolation
2. Guest Network - Enabled AP isolation
3. IoT network - Has all IoT devices including Homekit devices, TV and Printer. Disabled AP isolation
4. Work Network - Work devices

I listed out few things that I have done to give more context

- I setup few firewall rules based on the knowledge gained from here!. To connect IoT devices using Apple Home, I manually enabled mDNS on the router. Everything works fine when I am on Primary network locally

- I have started Synology SSL VPN with the following settings and installed the VPN plus app on Iphone and turned the VPN setting ON. I can access the router login page but CAN'T access to the printer or TV on IoT network. I also can't access the homekit devices on Apple Home app. I tried to use L2TP VPN and that resulted in the same end result as well

- The Internal IP address of all the 4 VLAN's start with 192.168..

- I have tried L2TP as well and the end result didn't change. Cant connect to Apple HomeKit devices on VPN

- I have no idea how to view/set/modify the state of homekit devices on Apple Home over VPN. Can anyone help please

- This is how I setup my Primary and IoT network

Yesterday, I reset the router and removed all the previous setting and firewall rules. I set up the VLAN's as is and tried to access the internal devices on VPN. However, I still couldn't get the access. These are the latest firewall rules after the restart

PS: I have enabled Threat Protection with the default settings. I have disabled the Threat Protection and still have the same issue

 

[fredbert]

Hi, welcome to the forum. Hopefully someone with a RT6600ax or other router with the SRM 1.3 RC installed will respond.

I'm still on SRM 1.2.5 so it's difficult to replay on VLAN interconnectivity and VPN Plus SSL-VPN. It may well be that the SSL-VPN gateway on the router is considered separate to the all the local VLANs.

I did a search for 'homekit TCP UDP' and found this Firewall rules for HomeKit with HomeAssistant

BTW looking at your firewall rules, the firewall is for all connections so a source of ANY will include the the Internet coming in. You should restrict access from the Internet to the bare minimum services that you wish to expose, and that probably [shouldn't] include Windows File Sharing (SMB/CIFS).

Also, you would be wise to disable SRM's UPnP and clear out the Client List. If you need the firewall rules that the UPnP clients want to create then you can add these yourself, but why go to the trouble of using VLANs only to allow the client devices to drill holes through the access control? Here's what it looks like disabled in SRM 1.2.5 ...

 

[SynFan]

Thanks for your reply and information on the firewall rules. I will look into that article to modify the firewall rules on the NAS that host the HomeAssistant VM

I have removed the UnPnP and windows file sharing from the firewall rules. The new list has only two rules.