Plex Media Access

Not sure if you were able to get it working or not yet. I was able to get it working by creating a new policy where source was WAN and service = "Plex" and destination was LAN with network set to my plex host. The Plex service was a new service I created using TCP srcprt = 1024:65535 dstprt = 32400. The issue I was ran into when I was first trying to set this up was random source ports not being allowed through. Fixed that by setting srcprt to 1024:65535.

Not sure if you were able to get it working or not yet. I was able to get it working by creating a new policy where source was WAN and service = "Plex" and destination was LAN with network set to my plex host. The Plex service was a new service I created using TCP srcprt = 1024:65535 dstprt = 32400. The issue I was ran into when I was first trying to set this up was random source ports not being allowed through. Fixed that by setting srcprt to 1024:65535.

I set "objects" for everything - services, hosts, groups, VLANs etc. I find it much easier to manage and the corresponding access behaviour seems more understandable (to me anyway!).

My port-based services generally have source set as 1:65535 by default and I've never had a problem - interesting that you have. Why would excluding protected ports make any difference I wonder?

Thanks for the info. Was this a network policy or a business policy that you created? It looks like a network policy but I cant really tell and I want to change some things that I am doing around.

Thanks for taking the time...

I do the same as you with creating objects for everything. I am also wondering about excluding protected ports. It does look like he is using a network rule vs a business policy. One thing i cant figure out is if using a business policy I can't see how to add the service groups vs entering the port numbers for port forwarding.

I based my source ports off of a default service which used 1024:65535. I don't think it would cause problems to allow all ports though. It would just be an any statement.

I believe this was a network policy.

You can't. For me it doesn't really matter, since the name of the rule tells me what it is doing and my setup is quite simple. I suppose for more complex rules, then the ability to add service groups rather than a port list would improve readability of the rule.

Thanks for the update.