Can I allow a client to access the LAN but not the internet?
Hi. Just re-did my home network with all Omada-compatible hardware (TL-SG2008, TL-SG2218, EAP660, TL-R605 router, software controller). Is there a way to block a client on my network from accessing the internet, but still allow them to access my LAN or parts of my LAN?
This would be to, for example, let my various IoT devices access Home Assistant on my home server but not allow them to directly access the internet - while letting my server itself have internet access.
I'm pretty new to networks so if it's more complicated than "there's a button for this" I'd at least appreciate a nudge in the right direction so I can research further.
Posted Apr 12, 2021, 4:20 PM UTC
23
You can write an ACL rule to deny access to the internet at the switch or EAP level. Create a group of the devices you want to block, under Settings-Profile-Group. The group can be by mac address or IP. If by IP make sure to reserve the IP addresses. Go to Settings-Network Security-Switch ACL and create a deny rule that prevents your created group from router access. This will still allow the devices to access the private lan and get an IP address, but prevents internet access.
Oh perfect, thanks! That seems to have worked perfectly.