Traffic generated by CAP to 127.0.0.1 (local capsman) is blocked by the default firewall rule: defconf: drop all not coming from LAN
Why? how can i solve this? How to tell the system that 127.0.0.1 is also part of LAN. LAN is the interfacelist for the default bridge.
I have another config with the same rules and there it works great.
You can specify on Firewall rule “src-address=!127.0.0.1”. Then incoming traffic will be dropped unless it comes from IP address 127.0.0.1.
yes i understand how to accept 127.0.0.1 traffic.
But why my traffic from 127.0.0.1 is blocked by the default rule: defconf: drop all not coming from LAN ?
On another device, same firewall rules, same firmware the traffic from 127.0.0.1 is not blocked by this firewall rule.
In the connection list i see the traffic is from 127.0.0.1
Because 127.0.0.1 in interface is not the one listed in LAN interface list. In fact there shouldn’t be in interface at all since it is locally generated traffic.
It works on other router most likely because configuration is slightly different.
In my cap settings i defined 127.0.0.1 but in my connect list i see also connections from src (my local device lan adress 192.168.101.1) port 5246 udp. And that traffic is blocked. Why not all my traffic from cap to local capsman is over 127.0.0.1?
You need such firewall rule in order to user router as a CAP and CAPsMAN at the same time and there are firewall input drop rules present:
/ip firewall filter add action=accept chain=input comment=“CAPs to CAPsMAN” dst-port=5246,5247 protocol=udp src-address=127.0.0.1