Edgerouter Firewall

In this video, I go over how to setup Firewall rules on an Edgerouter in order to lock down traffic between different VLANs.
We configure this where our Home network (VLAN 10) is able to access all other VLANs, (IoT:55 and Guest:100) but no other network can access it from the outside.
If you haven't seen the video where we configure the VLANs check it out. This is a continuation of that configuration.

[@ToastyAnswers]

I'm not sure where the comment went, or if it got deleted, but someone mentioned I should have explained the difference between WAN_LOCAL and WAN_IN a bit more in-depth. I think it was a valid comment and good constructive criticism and I probably didn't touch on it as much as I should have in the video. If anybody noticed, there are two "default" rule lists that are created. WAN_IN and WAN_LOCAL. WAN_IN is for anything coming from the internet, and ENTERING your local network. This means that it is passing THROUGH the router and hitting a host somewhere "inside" the network. If you were dealing with rules destined for a DNS server, (PLEX would be another example) this would be something blocked and/or allowed by the WAN_IN rule list since the traffic has to pass through the router in order to reach the destination host. WAN_LOCAL, on the other hand, is anything coming from the internet and is destined for the ROUTER ITSELF. Therefore, DNS forwarding, DHCP, SSH, Web interface, etc... will all be allowed/blocked by the WAN_LOCAL rule list. If it is something you would access directly on the router itself, then the WAN_LOCAL list is where you would allow or deny it. Also, this ruleset assumes it is coming from the public internet and is destined for the public interface of the router. I.e. it will not block traffic coming from the internal network to the internal IP of the router. Hopefully, this makes sense and I apologize if I didn't cover it enough in the video.

[@bigdoggetom6549]

I see a lot of people on the internet suggest that IN doesn't mean WAN > Local, but rather IN to the interface from anywhere (such as a computer IN to eth1 then OUT eth1). What's correct?

[@AndrewCislak]

@@bigdoggetom6549 - I am NOT qualified to answer this, but from my understanding, I believe IN refers to traffic coming into the router - from any network. I believe that would also include WAN

[@bigdoggetom6549]

@@AndrewCislak Since posting the comment I've finally got a better understanding Some WAN_IN would be anything that enters the WAN interface and goes into the LAN. WAN_LOCAL is anything from WAN that is destined for the router itself (eg. ping requests) When it comes to LAN ports, IN is any traffic coming into the LAN from any other network, eg. another LAN port, or WAN And conversely with OUT, LAN_OUT would be anything on LAN leaving the port to go somewhere else eg. another LAN or WAN. I've configured some VLANs now for a guest network and IoT network. The IoT, for instance, is on VLAN eth3.107, and my firewall rules are IoT_IN, so configured as interface eth3.107, direction in, and the rules are basically accept all traffic (so allowing WAN traffic), accept established and related (for sending control signals from phones), accept mDNS (port 5353, allowing for phones to detect the Chromecasts, etc.), and block remaining traffic to LAN networks

[@drewpix]

These ER videos are so helpful. Please don't ever delete these -- or I'll be screwed if I ever need to re-configure my setup! Much appreciated.

[@Kaotix_music]

um, yes....i second this. Ubiquiti should just pay this dude to make these videos official edge router X tutorial vids hahaha

[@Kaotix_music]

Commented on your last video on how I can have my "admin" PC, talk to my Pi servers on a different VLAN....dont comment back lol...this video answered it

[@MatthewMarcus]

Fantastic video. Just got an ER-X, and your vids have been invaluable! Thank you so much for taking the time to educate us in a clear, concise, easy-to-follow way. Much appreciated.

[@boswellstv-lp2im]

this was very helpful thank you very much. Watching it after the other one on creating vlans (except I don't have a cisco switch) was just what I needed. After setting the vlans up, I was really confused that I could ping across vlans. I thought I was done, and you weren't supposed to be able to do that, and I just hadn't done something right! Then I watched this video, implemented the rules that are right for my vlans, and I think I'm good now. 🤞

[@tlxreed]

This is great. I've just set up a guest and an IOT VLAN firewall rule set and had it work by watching this video. Previous attempt I bricked my Edgerouter and had to reset it. Next trick...I want to be able to have a device on the IOT or guest network access a home network server on a static IP and port. If your servers are on the 192.168.100 network, you still might want them to be able to do specific protocols and IP's to the IOT network initiated from either direction.

[@fjk5146]

Very nice explanation on how to setup firewall rules between VLANS on EdgeRouter. Your demonstration clarified a lot of confusion I had after reading the EdgeOS manual. Thanks for the nice video.

[@michaelsasso13]

This video has been very helpful. Just one major point which caused me hours of frustration (thanks MS-Windows). The Windows 10 Firewall issue noted around the 7:45 mark is a big issue...initially I had Windows-10-Firewall enabled on all PC's in different subnets, and the ER4 Firewall Rules did not help because Windows-Firewall blocks outside subnets.

[@pilotwasif]

Thank you so much. Very informative and useful. You have helped me resolve my FW rules issue. Thank you once again,

[@PCman50]

Can't tell you how grateful I am for your tutorial here. I've been totally lost in how to setup a VLAN. I have at least 40 IOT Devices on my home LAN with no isolation between my personal workstations, laptops, cell phones, etc. Information I find or asked for help on how to isolate my IOT Devices yet still have access to them was sketchy and over my head. I do have an inexpensive TP-Link TL-SG108E (never used) that says it supports Vlan. But not sure as I was overwhelmed at starting something I knew very little about. Maybe that's with a try first? And I can always get the Ubiquity. Any suggestions or thoughts very much appreciated. Thanks again for your great tutorial.

[@ToastyAnswers]

I'm glad you found the video helpful! VLANs can be a bit overwhelming at first, but aren't too bad once you get used to them. Most switches that support VLANs are mostly the same when it comes to configuration. Most of the differences comes down to the individual interfaces and terminology used. I would give the TP link switch a shot and try to setup a second VLAN to start. The good thing about VLANs is that they're a standard, so if the switch supports it, the functionality will be very similar across different brands/models.

[@matthewcastrigno6138]

@ToastyAnswers Thanks for this video Mr. Toasty! I do appreciate it! I have an EdgeRouter but it is an ER-8 not an X. I have a question if you don't mind.😁 Q: At 4:39 in the video you are applying an interface for the Guest Ruleset. My question here is if I had more than one network (vlan) that I wanted treated this way, say Guest1 and Guest2, could I add the second Guest network interface here without it allowing traffic between Guest1 and Guest2? Or do I have to make another rule of some kind? My use case is that I have a number of networks that need to be isolated from each other except my "home" network needs to access them without the "Guests" being able to access my home, as you describe here. Thank you so much, any comments appreciated!🙂

[@ToastyAnswers]

I "believe" you have to have a separate ruleset for each guest network, as they are separate virtual interfaces. I can think of a few exceptions, but I don't want to spitball them here because I have not tested them. The way I would go about it is creating separate rulesets for each Guest network. They should essentially work the same way by only allowing traffic from other networks you designate as "allowed". Hopefully I didn't misunderstand your question.

[@matthewcastrigno6138]

@@ToastyAnswers My situation does not match yours exactly as you have these "switch" interfaces that I do not. I don't think that is a feature of the ER-8. I could not directly connect, with a PC for example, on the interface if it was a vlan. I had to just specify a network. I was able to apply the same rule to multiple ports each with different networks. I can't post images here otherwise I would.

[@matthewbennett2844]

Great tutorial worked out for me.

[@MikeTheMan1961]

Vere, very good and helpfull

[@BabcockFarms]

Excellent video, it helped fill in some holes in my networking knowledge. My background is virtualization and storage, not networking. I have my firewall configured very similar to what you have in this video. I would like to create access to one specific IP address on a VLAN that is blocking all internal traffic. How would I go about that?

[@ToastyAnswers]

You could basically create an allow rule on the VLAN which is blocking internal traffic from to .

[@nukedathlonman]

I just did this to my mom's network... Not sure why, but the GUI/SSH servers are available on all gateways and all lans have access to all the gateway IP's - possible bug in EdgeOS 2.0.9 (hotfix 7), but then again, it could be a possible bug in my access point (Archer C7 v4 with OpenWRT 23.05.3 - that was hard getting VAN's up and going on & wouldn't surprise me if it's causing a few routing bugs) or switches (three Sodola Networks 9-port managed switches). But the actual device isolation between VLAN's is working perfectly, so there is that going. 🙂

[@MarcioFranco]

hi one more question how to create a list of allowed ips and block everything else, i want to create a white list of ips for browsing.

[@darbuthnot99]

newbie here....i set up a similar config to separate LANS on the router as I'm not using vLANs but noticed that my guest LAN could still reached the GUI on the non-guest LAN listening port. So I added a rule on the guest LAN to block local as well and that seemed to solve my issue. Does that sound right?

[@johncastaneda4365]

Hi Toasty! Thanks for the awesome videos! Learning a lot on this channel. QQ: ON your previous VLAN setup video, you set up a "test" VLAN just in case if you lost connection to both the EdgeRouter and the Cisco Switch. Was that a temporary set up or is it still part of the configuration? if it's part of the config, would you need to setup firewall rules for that as well?- Thanks!

[@ToastyAnswers]

That was just a temporary set up. It's an interface a deleted after everything tested good. If you left it, you could put firewall rules on it and use it as an additional VLAN. At that point it wouldn't be a "test" anymore haha. There are quite a few comments here asking about that VLAN. I really shouldn't have created it as it was unnecessary. Just something I did to give myself peace of mind. I explain in other comments how it really didn't matter if I created it or not.

[@johncastaneda4365]

@@ToastyAnswers Great. I guess I was too lazy to read the rest of the comments on here. Otherwise, you didn't have to repeat yourself Ha! I just bought my first ubiquity router and going to set up firewall rules following your steps here. Keep up the great work! Another subscriber added to the list! Best!

[@GeorgeLaci-z8t]

I think DNS its not goint to work for the guest and the iot network. Probably the vlan interfaces needs to be added on the dns settings

[@13n1304]

Awesome! My Edgerouter X is (hopefully) going to arrive tomorrow and this is exactly what I needed to know. Well besides figuring out how I can add vlan tags to individual clients on my wifi ap (hostapd on raspi) and maybe my containers.

[@ToastyAnswers]

Awesome! VLAN tags for individual clients will not technically be possible. You can only assign a VLAN per SSID and I believe the limit is 4 SSIDs per radio (could be wrong, depending on AP model). If you are looking to segregate EVERY wireless device you may need to look into private VLANs which are a bit different, but may be what you are looking for. I've personally never configured private VLANs on the Edgerouter.

[@13n1304]

@@ToastyAnswers Based on the documentation it seems to be possible (seems like you can map MAC - VLAN and each MAC has it's own password) but I will keep your advice in mind. Maybe setting up a different SSID would be better. It doesn't need to be super secure but my goal is to separate some devices form other family members somewhat from my own

[@atomixcar]

great job

[@celebrir]

Hi Toasty, That was a great video! I was wondering if you were planning on doing a follow-up on this video with QoS with focus on multiple VLAN + Guest VLAN. Optimizing the network to favor certain subnets and then having the router favor certain packets, limiting the VLAN wich has the Server on there so it won't eat up all of my upload when someone downloads something off of my NextCloud, or reserving some upload/download for myself so my gaming won't be bothered….

[@ToastyAnswers]

I wasn't planning on it, but I can see if I can put one together. I can probably put something together using the manual QoS rules, but a lot of that would fall under enterprise QoS which is a massive rabbit hole. Also, doing full-blown QoS on a home connection has some limited success, but it can be done to a degree.

[@pyrox33]

Just watched this great video, I just bought this equipment for home use and was wandering if these same firewall rules would work on lans setup on the other ports of the edge router to avoid using a managed switch, say if home was on eth2, Iot on eth1 and Gest on eth 4.... If so where could I find help setting up the edge router that way ?

[@MarcioFranco]

Great video, but how to block the access of the IOT and Visitors vlans towards the Router's IP?

[@ToastyAnswers]

I forget the exact command, but setting the "gui listen-interface" should automatically block access from all other LAN interfaces. However, if the other subnets are able to route to the listen-interface then this effectively does nothing. You will need to setup firewall rules for the LAN interface and setup access rules. This would involve creating a new firewall group called LAN_LOCAL and assigning it to whichever interface you are wanting to limit traffic on. Then, set the rule to apply to the direction of "Local". From there, you can create rules on which source networks are allowed to actually access the interface itself.

[@MarcioFranco]

@@ToastyAnswers Hi, thanks for quicly response, i found this article on ui.com help.ui.com/hc/en-us/articles/218889067-EdgeRouter-How-to-Create-a-Guest-LAN-Firewall-Rule i tested and works good, and is exactly how you told.

[@Mouratidis]

@@ToastyAnswers Can you show us please how to do that,we need the configuration,thanks!

[@jcbyc]

Thanks so much for this video! Loving the ER. If using a Unifi AP, do the firewall rules also need to be added to the Unifi Network controller, or is that overkill/a potential source of problems?

[@ToastyAnswers]

No, the firewall rules don't need to be added to the controller. A lot of the firewall/routing configurations in the Unifi controller only take effect if you have a Unifi gateway device (USG or UDM). Adding the rules here won't do anything if all you have are wireless APs.

[@stevesmith2553]

those vlan\s (subnet) should not be able to ping each ., unless it's a layer 3 switch

[@dr.mikehughes9874]

Hi Ian: I’m wanting to setup 3 maybe 4 VLANs. Here is the issue I’m not sure about. I have a Cisco Router SV260W default gateway of 192.168.123.254. I have an Ubuntu Webserver static on 192.168.123.104. I am forwarding ports 8083 and 8080 to that address as well for the Server. So would like to leave that setup alone if possible. I have the following Ubiquiti equipment. 24 port POE switch, an 8 port 60 watt switch, 4 of the 5 port mini flex switches. I’m wanting the following VLANs. One for IoT, one for guest wifi access and one for my main LAN like doing my video editing. I also have a cloud key gen. 2. Do I have to set the VLANs in the Cisco router and the the 24 port switch. I even thought of changing over to an Edgerouter X even. So looking for some ideas on implimenting.

[@andreabiasci973]

Thanks! Everythink works! But i have one question: What rules i need to add if i want ping from the "switch0" to a vlan? This tutorial is made for pings vlan to vlan.. but in my case i need access a vlan from the "switch0 interface".. Thanks

[@ToastyAnswers]

You would need to add the IP (or subnet) of switch0 to your access rules as well. Basically, treat switch0 as yet another VLAN you are granting access to.

[@NathanFernandes]

can you please do a video of port forwarding with this setup

[@ToastyAnswers]

I'm not sure why it hasn't occurred to me to make that yet... I've added it to the list!

[@Tigger-gn7xi]

Can you do a video on setting up firewall rules on an edge router to prevent pi-hole bypassing?

[@ToastyAnswers]

This might be something I can do as I've setup a few rules to do just this. However, I will say that fighting DNS bypassing as well as proxy use or VPN utilization is quite the losing battle. You can only do so much.

[@Mpirani1]

Hey can you please explain how to, using the GUI, Block all internet traffic at a certain time on the EX-R using the current firmware, the options are a little different then what is shown in the video. tnx

[@Foxstang34]

Your setup is exactly what I want to do with my Edgerouter POE 5 but can this be done with just my edgerouter poe 5 without a switch? Also will this vlan setup work through my nano hd ap? Thanks for the informative videos...

[@ToastyAnswers]

It will all depend on how many devices you are wanting to serve and the number of networks. It is possible to do the same setup as this video on a POE5, but there is a limitation that doesn't exist on the ER-X. You can only use ports Eth2-4 as switch ports. Yes, the VLAN setup will work with your AP.

[@matthewbennett2844]

Do you need to add rules to allow for DHCP and DNS to work ?

[@ToastyAnswers]

If DNS and DHCP are on a separate network then you will need to create rules to allow the traffic.

[@CristianZamora]

How about when I'm using my ERL 3 as my dual wan router in front of my Orbi router? Can these firewalls be used where the ERL is just the dual wan gateway?

[@ToastyAnswers]

Yes, you can setup the firewalls for this as well. However, you will be limited to the gateway network and will only be able to filter traffic at that level.

[@moisesgomez1767]

Instead of creating a vlan 10 for your home, can you use the switch 0 instead ?

[@ToastyAnswers]

Yes, this is actually the way I have mine configured.

[@moisesgomez1767]

@@ToastyAnswers thank you so much

[@erickbostrom4049]

Hello, Wonder if you think it is a firewall issue that a new Edgerouter is connecting with PPPoE and all devices are online but the vonage adapter will not connect anymore when it did not need any special setup on the old netgear X10 router, same with the UniFi controller software running on my machine, the UAP-AC-PRO is no longer found but is online as all wireless devices are connecting just fine. thx for any feedback. or a video idea for users looking to move into the Ubitquity universe.

[@ToastyAnswers]

Sorry for my late reply. I saw your comment a while ago, but I didn't know what to respond with. I've never used PPPoE on the Edgerouter or Vonage. I'm not entirely sure why the setup and reliability would be different from a Netgear X10. I wish I had more information for you.

[@66maelstrom]

Question. If your switch.0 address is 192.169.5.1, that is your default LAN, do you have to add it to the PVID for the vlan aware or will it just act as the default vlan ID to connect to your downstream switch? So just add say vlans 10,55,100 and don't list the PVID?

[@ToastyAnswers]

Yes, switch0 is considered the default LAN. If you do not list a PVID in the configuration, it will default to using the switch0 interface for un-tagged traffic.

[@Profielkanaal]

@ToastyAnswers After having setup the firewall rules as described in your video, it seems that NAT loopback (hairpin NAT) isn't working anymore. It seems to be related to the 'home' rule. As soon as I remove the interface from that rule, I'm able to access my webserver again from wihtin my home network. How can I make it to work with that rule enabled?

[@ToastyAnswers]

I believe I might have replied to this via e-mail already. Just let me know if that isn't the case... hairpin NAT is a bit of an issue on Edgerouters and I have plans to record a video on this.

[@Profielkanaal]

@@ToastyAnswers You did indeed :) I got it working meanwhile, but as I don't know if it is the right way of getting it working, I didn't post my 'solution' here. However I've sent it to you via mail so you can assess it.

[@joaquinluceromusic]

BLOCK SSH using the firewall would do

[@RobertHorvat]

where did you get switch 100?

[@ToastyAnswers]

It's the virtual interface created for the "Guest" network. Since the VLAN I assigned the interface was VLAN 100, the interface it created was Switch.100 accordingly. The VLAN numbers are really just for the sake of example. You could use any (valid) number for your VLANs.

[@ChrisArkwright]

Soooo I set the listen address and now I cannot access it from any address... Is there a way to fix that or am I SOL?

[@ChrisArkwright]

Nevermind, I was able to log in via SSH and make changes. Had a nice little exercise in CLI commands. I misunderstood that the IP address is not the address of the device you are accessing from... Lesson learned.

[@ToastyAnswers]

That's how you figure stuff out! lol j/k, but yes, the listen address is the address of the router you want to connect to.

[@spacegurra]

I did "set service gui listen-address 192.168.xx.1", but can still access login screen rom any VLAN

[@ToastyAnswers]

How does your local rule for the 192.168.xx.1 vlan look? The _Local rule list should be disallowing any connection from another subnet by default. Are you able to hit the login screen on any interface IP or only on the one set by the gui listen-address command?

[@s_c_r_e_a_m_l_a_n_d]

Had this issue too, trying to work out a way now...

[@s_c_r_e_a_m_l_a_n_d]

Had to hard restart and router and GUI popped up *phew*. Thanks for help with all the routing! :)

[@wilco886]

How do I portforward to a webserver or minecraftserver or anything

[@ToastyAnswers]

Under the "Firewall/NAT" section, the first tab you are taken to is the "Port Forwarding" tab. Just select your "WAN Interface" (typically eth0) and LAN interface (typically switch0) and then enter your port-forwarding rules in the section. For example, Minecraft uses port 25565 by default so the sections would be filled out like-so. - Original Port: 25565 - Protocol: Both - Forward-to Address: - Forward-to Port: 25565 - Description: Minecraft Server

[@wilco886]

@@ToastyAnswers I have tried it that way but it doesn't work. I have a vlan setup for my servers which is almost the same as your guest vlan minus the IoT access. I've set the original port to 25565, protocol to both, the address to 192,.168.20.22 and port 25565. In ubuntu ufw is set to allow traffic on port 25565. The vm used to work with my old router so I don't expect that to be the problem.

[@ToastyAnswers]

That is weird. I'm not sure what would be causing the issue unless the firewall isn't automatically allowing the NAT traffic through. You may need to manually create a rule allowing that port through.

[@wilco886]

@@ToastyAnswers I've managed to get it working about an hour or so ago. I ended up making some NAT rules and added a rule to the WAN_IN. However I still don't know why the regular portforwarding doesn't work. The auto firewall option is turned on.

[@ToastyAnswers]

Glad you got it working. It's weird, but I've known the auto options to be finicky sometimes.