I have a SOHO MK3 and intended to use it to provide cellular failover for certain endpoints while blocking other endpoints. Prior to purchasing, I reviewed the manual for v6.3.3 to confirm it would fit my needs.
Now that I have the device and have configured it, I am running into an issue.
Under Advanced / PepVPN / Rules, I have a default any/any rule (at the bottom) set for “Priority” algorithm with “WAN: WAN” at the top and “WAN: Wi-Fi WAN” below it. “WAN: USB” is under the “Not in Use” heading.
For the devices that are supposed to be able to communicate over the USB modem, I have individual rules to allow them based on source IP. These are also Priority rules but include “WAN: USB” as the third/bottom connection option.
Generally, this works well. When I drop the wired WAN connection, the USB connection comes up and the devices allowed out work as expected while other devices are not allowed to traverse the USB connection.
However:
I have one device that, despite rules set otherwise, is still allowed to communicate out over the USB WAN connection. I have created an “Enforced” rule to set this device’s IP to “WAN: WAN” and tried a rule to set the device’s MAC address enforced as well. Despite these rules, this device continues to be allowed out over the USB connection. For what it’s worth, the device is an Aruba RAP-3WN remote access point that tunnels back to my office.
I’ve contacted support from the reseller that I purchased the SOHO from but that ended with a declaration that the rules on the SOHO are meant for the PepVPN and aren’t really intended to do what I am trying to do.
Before returning the device, I wanted to check here first in hopes of finding some better news.
mjburns -
Thanks for the pointer but those are the policies I am using (they are under Advanced > PepVPN > Rules on the SOHO). I don’t have any firewall rules in play at this point.
The first two rules are for the same device, one by destination IP and one by MAC (I’ve also had the same behavior with source IP, just didn’t have that rule configured at the time I took the screenshot). Both are set to enforce wifi-wan which isn’t connected. Despite this rule, this device is able to connect out over WAN and USB.
The 3rd, 4th, and 5th rules are for devices that are supposed to be able to communicate over USB when that is the active connection - this all works as expected.
The 6th/last rule, “Traffic default” allows everything else use of WAN and WiFi-WAN but not USB. With the exception of the Aruba device, this also works as expected.
When I have the WAN disconnected/unavailable and the SOHO has made the USB connection active, my “Active Sessions” shows two sessions that should be permitted and one session from 192.168.50.24 that should not.
