Blocking internet to a specific LAN IP with exceptions

Hi Nicholas Bethard,

You need to create a firewall rule on top of the Reject rule to allow DNS traffic.

After that, you can just add an exclusion in the Reject rule for required URLs and services(HTTP and HTTPS for web traffic).

This makes total sense! But I still can't get it to work. It seems that things start acting odd as soon as I enable the DNS rule. I created two rules similar to what you suggested. "iPad" is the IP address assigned to the iPad being used to test this.

If I disable both rules, browsing on the iPad works properly. If I enable only the DNS rule, browsing mostly doesn't work (Google still works for some reason, but as soon as I try to click on a link from a search, it doesn't work).

The DNS rule I created is very simple, see below. Why is explicitly accepting DNS breaking browsing?

I think I figured out the answer using Yash's post as a clue. Instead of a separate rule like Yash suggested, I added the DNS servers I use (1.1.1.1 and 8.8.8.8) as well as the DNS service to the reject rule's exclusions (as well as ICMP for testing). Now it works. Hooray.

I suspect part of the issue is the XG is not part of your DNS chain. You should be pointing the device DNS at the XG DNS and then point the XG DNS at your choice of DNS providers.

Ian

Probably right, I'll have to tinker with that later. Thanks!

Probably right, I'll have to tinker with that later. Thanks!