Firewall rule to allow internet connection

[burkinar]

Hello team,
how to allow internet connection to a certain device when the connection switches to mobile connections? I have RUT951 with last firmware version.

[Edvardas]

Hello,

I have a few questions regarding your preferred setup.

1. What other WAN sources there are in this network?
2. Could you share topology of your network?
3. Should the device that will get internet access once device switches to mobile always have internet access?
4. Do other devices maintain internet access once failover is in use?

As a current solution I can suggest you to:

1. Remove mobile interfaces from wan zone and create a new mobile wan zone with mobile interfaces that matches the settings of wan zone.
2. Create traffic rules that blocks/allows traffic for different devices with different wan zones. More information about traffic rules: Firewall traffic rules - Teltonika Networks Wiki

Also, there are failover scripts that are ran once the failover appears. More about scripts you can find here: [OpenWrt Wiki] mwan3 (Multi WAN load balancing/failover)

Here is a quick guide how to enable failover, create firewall zone and some basic traffic rules that would allow one device to have internet access once mobile connection is in use:

1. Navigate to Network→Failover→Multiwan, here enable failover for your network interfaces.

2. Navigate to Firewall→General Settings, scroll down to Zones and click Edit on Wan→Reject zone. Here remove mobile interfaces from covered networks and click Save & Apply. Now press Add button in the newly opened tab match the settings that are in Wan→Reject zone and press Save & Apply.

3. Now navigate to Firewall→Traffic Rules and scroll down to the bottom. Here you can enter the desired name, select protocol from the dropdown menu and press Add. In the newly opened tab, you can configure your first traffic rule, mine looked like this and it allowed device to have internet access:

Second rule that blocks internet access through mobile wan to all devices that are on lan:

These two rules allow only one device to have internet connection through mobile wan.

Now configure the rest of the traffic rules in order to achieve the desired network set up.

Note: Traffic rules have priority from top to bottom, if this set up that I made works for you make sure that the first rule is the one that allows internet access to the mobile interface for specified devices and then the one that blocks internet access.

Best regards,

[burkinar]

hello @Edvardas
Thanks for the answer I see the logic in your solution, I will implement the solution and test when I am next to the router. Currently I am on a two week vacation. I will come back to you with an answer if the solution you gave works