[student13]

Hi, I have a voip / ATA box (Grandstream HT 812) hooked up to my Linksys WRT1900AC by Ethernet cable.

I wish to create an iptable rule to restrict communication of that voip box to the internet only, no communication to other devices on my network...(My intent is that someone will not be able to use my voip box to redirect traffic on the network or communicate /see other devices on the network).

Good to know:

-I did not know how to exactly search for this topic, and the results I got were confusing.

- I have a wireless virtual lan, a "guest network" that restricts my wifi android TV box to the net, on 192.168.20.1.

-HERE ARE my iptables rules, my printer is static ip on
192.168.1.110

iptables -I FORWARD -s 192.168.1.110 -o `get_wanface` -m state --state NEW -j REJECT
iptables -I FORWARD -p tcp --dport 20005 -j REJECT
iptables -I INPUT -p tcp --dport 20005 -j REJECT
iptables -I OUTPUT -p tcp --dport 20005 -j REJECT
iptables -I FORWARD -p tcp --dport 9100 -j DROP
iptables -I OUTPUT -p tcp --dport 9100 -j DROP

THANKS.

[Per Yngve Berg]

1) Separate the Voip box on a separate VLAN and IP sub-net.

2) VLAN does not work on the Marvell chip-set. Replace your Linksys WRT1900AC with a Linksys EA8500, Netgear R7800 or Broadcom based unit.

See the Marvell forum for the hardware capabilities for your router.

[student13]

[Per Yngve Berg]

You have mixed up the terminology.

VLAN = wired ports on a switch.

VAP = An extra SSID and sub-net on a wireless AP.


VLAN is cipset dependant. You have to post in the Marvell forum.