I want to use a hEX for the connection and separation of two LANs. LAN 1 is my internal LAN in my appartment and LAN 2 is for wallboxes in the garage.
(A) I want to communicate from LAN 1 to the load management and wallboxes in LAN 2
(B) I want to block communication from LAN 2 to LAN 1
(C) I want to communicate from LAN 2 to the internet to make updates.
I read parts of the wiki and tried a bit in the configuration but I don’t know how to start correctly.
Does it matter which ports of the hEX I use for which side. Is one solution more practical?
How do I configure the forwarding from LAN 1 to LAN 2? Using route, bridge, …?
Do I have to add a route to the Internet-Router (FritzBox)?
Use hex as router, not Fritzbox. It’s easier that way.
Unless that Fritz is doing something else not shown on your drawing ?
Ports don’t really matter. Preference is to keep eth1 as connection to internet via Fritz.
Use eth2 for LAN1 and eth3 for LAN2.
Setup DHCP on eth2 with proper pool for lan1.
Same for lan2 and eth3.
For communication, provide route dst-addr subnet of LAN2. Gateway eth3.
For blocking, simple drop rule forward chain, src address subnet of lan2, dst addr subnet on lan1.
All the rest will pass then.
The setup is unnecessarily complicated by having the hex as a router.
Much better to setup up TWO LANS, I prefer VLANS and use the hex as a switch for example or as suggested ditch the fritz if possible.
If you wanted the garage to have access to the house but not the other way, then it would be as simple as connecting the hEX as if it were an internet router (the default config would work). And the FritzBox would see all traffic from the garage as coming from the hEX’s WAN ip address.
But that isn’t what you want. You want the home to be the “secure” network, and that makes things significantly harder, because your FritzBox is router that is providing dhcp services for all home devices, and is most likely advertising itself as the “gateway” to the internet for all addresses that are not part of 192.168.1.0/24. So when your home PC that you want to connect to the garage subnet 192.168.25.0/24 trys to connect to the garage load management device at 192.168.25.2, it will recognize that 192.168.25.2 is on a “foreign” network, and pass the routing deciscion to the FritzBox at 191.168.1.1. And if you can’t put a static address in the Fritzbox, then it is going to try to send it out the default route to the internet (or it may recognize that it is an rfc1918 private address and just drop it).
You leave out some necessary details. Do you want the Garage to have access to the internet? I.e. everything but 192.168.1.0/24? Or do you really want it to be isolated unless talked to from 192.168.1.0/24? Are all the devices in the garage set with static ip addresses, or were you expecting the hEX to be the dhcp server for the garage?
If you want it isolated, and all garage devices have static addresses, you should be able to configure using the default setup, with the following changes:
Set LAN address to 192.168.1.5/24 and turn off dhcp server for 192.168.1.5
Set the WAN address 192.168.25.1 (you could set the WAN gw to 192.0.2.1 (TEST-NET-1) or you could use route type=blackhole (simply drop packet) or unreachable (reject)
Add static route to FritzBox for 192.168.25.0/24 via next hop 192.168.1.5 (the hEX “LAN” address).
I just noticed your requirement C: Allow internet access from LAN 2 in garage.
So the “backward” config with the HEX wan pointed to the gararge will not work.
You will need to turn off nat, and play with the firewall to configure LAN 2 like a “guest” network that will block access to 192.168.1.0/24 except for established/related connections.
Sorry for leading you down the wrong path. I haven’t mastered the ROS firewall yet, so someone else would be a better resource.
