Page 1 of 2 12 LastLast
Results 1 to 10 of 11
  1. #1
    Newbie
    Join Date
    Jan 2021
    Posts
    7

    Default Accessing Expert Mode

    Hi,
    i am using Untangle in a proxmox VM. It works great. I would like to use source ports as part of some firewall rules though and saw that it requires expert mode. I emailed support as instructed to learn how to activate expert mode but since I do not have a subcription, I just received a canned message back offering me support options. I looked around and really could not find information how to convert an active install to expert mode (if such a thing is possible). I know that untangle has specifically requested instructions on converting to expert mode to not be made publicly available to prevent too many support issues. Would someone please PM instructions on how I can change my installation to expert mode?

    Thanks!

  2. #2
    Untangle Ninja sky-knight's Avatar
    Join Date
    Apr 2008
    Location
    Phoenix, AZ
    Posts
    26,393

    Default

    Yeah, there are a few things that Support was ordered to keep tight to their chest like this that we're now in a dark place on.

    Untangle is going to have to cough up those details and document them finally, because while I know about what you're asking, I also don't now how to unlock that feature.

    I'm curious as to your use case however, because source port is almost universally not what you want. FTP is the only protocol I can think of that would match on it.

    What are you trying to match?
    Rob Sandling, BS:SWE, MCP
    NexgenAppliances.com
    Phone: 866-794-8879 x201
    Email: support@nexgenappliances.com

  3. #3
    Newbie
    Join Date
    Jan 2021
    Posts
    7

    Default

    Well I have an iot vlan and a main vlan. I am trying to set up rules so that I can do things like use my rokus to stream audio for private listening and chromecast. I found great instructions from the ubiquiti subreddit and some of the rules require matching source ports.

    It’s just amazing that support asked people to keep this secret and it really seems like it doesn’t exist on the internet.

  4. #4
    Untangler
    Join Date
    Jan 2019
    Posts
    90

    Default

    Note: Chromecast across VLANs is a bit of a lost battle on Untangle due to the lack of support for an mDNS repeater (unless you implement one separately e.g. running Avahi on a Linux box).
    CMcNaughton likes this.

  5. #5
    Untangle Ninja sky-knight's Avatar
    Join Date
    Apr 2008
    Location
    Phoenix, AZ
    Posts
    26,393

    Default

    I'd need more details because my Plex server doesn't require any of that. It's just a single web port accessed on the server and everything else just works. I can stream off that to my Roku's, phones, everything.

    And since the firewall isn't default block, the only way it's being blocked is if you made a rule to block it. So you make a rule that allows the streaming server to do whatever it wants on egress and poof... no more source port requirement.

    But beyond that I'd like to read what you're referencing because again... there's only 1 case I know of where source port is appropriate, and that's active FTP, which no one uses.
    Last edited by sky-knight; 01-04-2021 at 08:30 PM.
    Rob Sandling, BS:SWE, MCP
    NexgenAppliances.com
    Phone: 866-794-8879 x201
    Email: support@nexgenappliances.com

  6. #6
    Newbie
    Join Date
    Jan 2021
    Posts
    7

    Default

    Actually chrome cast may have been a bad example. I have a separate proxmox container set up with avahi and it seems to work fine although I don’t use it to stream too often. I have noticed that my speaker groups don’t appear as streaming options which seems like a common issue when on a separate subnet.

  7. #7
    Newbie
    Join Date
    Jan 2021
    Posts
    7

    Default

    So I primarily want it for private streaming. I frequently use the roku app to control my TV. It works across subnets and seems to find the two roku boxes in my house. However, when I try to activate private streaming, it fails. If I change my phone to the IoT vlan it works fine of course.

    Here is the reddit post I was referencing. I do not know for sure, but since his post seemed to specify setting up rules based on some source ports, I wanted to give it a shot and try it.

    I have placed default rules to block my IoT vlan from accessing my home vlan in the filter.

    Honestly, everything works great and I am really happy with it, I was just hoping to tune it up a little bit with this.

  8. #8
    Untangle Ninja sky-knight's Avatar
    Join Date
    Apr 2008
    Location
    Phoenix, AZ
    Posts
    26,393

    Default

    You're going to need to deploy an mDNS service, Untangle doesn't support one and no amount of firewall wizardry will get around not having it for that specific technology.

    But to put it simply, that tech isn't designed to operate beyond a network barrier.
    Rob Sandling, BS:SWE, MCP
    NexgenAppliances.com
    Phone: 866-794-8879 x201
    Email: support@nexgenappliances.com

  9. #9
    Newbie
    Join Date
    Jan 2021
    Posts
    7

    Default

    I have avahi running in a proxmox container inside my network. Before that, the app didn’t find my roku boxes. That’s why I wanted to see if adding those source port rules would allow for private listening.

    Whoops and here’s the Reddit post:
    https://www.reddit.com/r/Ubiquiti/co...tm_name=iossmf

  10. #10
    Untangle Ninja sky-knight's Avatar
    Join Date
    Apr 2008
    Location
    Phoenix, AZ
    Posts
    26,393

    Default

    Again, those rules are pointless if you don't have connectivity.

    Untangle by default doesn't block anything between any VLANs, so unless you've created rules to do that... pass rules based on source port won't help. You can bypass the need for source port entirely by simply making a rule that says source address, destination interface any-non wan, pass. Limiting that rule further to a specific source port doesn't increase your security at all anyway.
    Rob Sandling, BS:SWE, MCP
    NexgenAppliances.com
    Phone: 866-794-8879 x201
    Email: support@nexgenappliances.com

Page 1 of 2 12 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

SEO by vBSEO 3.6.0 PL2