[Howz]

Hi all,

I have a USB storage which can be accessed without issues. The VAP has net isolation and has internet access but it wont connect to the USB storage via SSH.

Let's say I'm working with one router so the SSH looks like this:
root@192.168.1.1

And my PC is connected to VAP at:
192.168.50.123

I'm only interested in allowing traffic from this IP only, not the whole subnet.

Which iptables rules do I need in the firewall to allow this traffic?

Thank you.

[egc]

try:

[Howz]

egc,

This is what I have tried and nothing worked. I'm not sure which interface I should use. ifconfig command shows ath0.1 with the ip I've given the PC. I've even tried using the MAC address that shows under Status >> LAN >> DCHP Clients. I've no idea how to use iptables properly.

iptables -I FORWARD -s 192.168.50.123 -d 192.168.1.1 -j ACCEPT
iptables -I FORWARD -o ath0.1 -s 192.168.50.123 -d 192.168.1.1 -j ACCEPT
iptables -I FORWARD -o eth2 -s 192.168.50.123 -d 192.168.1.1 -j ACCEPT
iptables -I FORWARD -i br0 -o ath0.1 -s 192.168.50.123 -d 192.168.1.1 -j ACCEPT
iptables -I FORWARD -p tcp --dport 22 -m mac --mac-source 'my_mac' -j ACCEPT

Any other ideas?

Note: I've only run these commands one at a time. I have not added any of these rules to the firewall script.

[student13]

Is your USB router attached storage smb or FTP?

Why don’t you try FTP and allow pass through using variation of above rules

[Howz]

Neither, I use SSH with a file manager like WinSCP or Midnight Commander.

Let me try to clear the confusion.

I have a USB enclosure connected to a Netgear R7800 router. Then enabled Core USB Support on Services >> USB.

No FTP, no Samba.

I can connect via SSH without any problems from the default vlan. I can also connect fine from the VAP but I would have to disable net isolation which I don't want to do. What is not allowing me to connect, I think, is the router's firewall. That's why I'm trying to get a rule added to iptables for this PC.

I haven't attempted FTP as it's not a setup I desire. I normally connect using SSH with root@192.168.1.1 and then entering the password for the router. I would assume if SSH doesn't work from an isolated VAP, neither would FTP.

Perhaps you could shed some light as to why FTP would be any different.

[kernel-panic69]

You have only core USB support enabled and not USB storage?

[egc]

As you are using the router itself try this rule:
iptables -I INPUT -s 192.168.50.123 -j ACCEPT

[Howz]

@kernel-panic69,

Yeap, USB storage is also enabled.

@egc,

The Input chain did the trick. I tested the previous rules one by one with some minor adjustments and they all work.

Thanks!