I tried searching the forums and there is quite a few posts regarding VLANs and firewall rules. However, throw CAPsMAN in the mix and things look different.
Let me address my main points of confusion:
- To have your traffic on your CAPs go anywhere you have to create a bridge on the CAPsMAN, even when using local forwarding. You select that bridge in your CAPsMAN configurations. So, it’s a bridge on your CAPsMAN router that becomes part of your CAPsMAN configurations which are then applied to CAPs even though those don’t have that exact bridge.
- In contrast to that: If you want one of your wifi networks’ traffic to be tagged with a VLAN ID, you don’t first create that VLAN on your CAPsMAN (e.g. Bridge → VLANs → New Bridge VLAN). No. Instead, you simply select it in your CAPsMAN configuration in Datapath → VLAN Mode (use tag) and VLAN ID (the id you want to use).
I found this:
OK, but how do I set up a firewall rule that takes the VLAN into account?
From a different thread:
A CAPsMAN VLAN does not appear as an individual interface, does it? So, how do I do this? Do I have to create a bridge VLAN on the CAPsMAN and use that somehow, similar to how one has to create a bridge on the CAPsMAN to use on the CAPs?
Oh, wait, I just discovered I can independently of VLAN ID etc. make a CAPsMAN interface be a member of a specific interface list. I could then use that interface list in my firewall rules. Except, those interface lists would be only on the CAPsMAN router, not on the CAPs, right? So, how can I create a firewall rule on my CAPs that uses an interface list from my CAPsMAN router? I don’t see how this would be possible.
Does this mean my only course of action is to use manager forwarding mode so all traffic is sent to the CAPsMAN router and I only have to mess with firewall configs there?