WSD and Bonjour service block

[fox983]

Hi all!
I need to block printer discovery from VLAN to LAN. I've set a rule that blocks all traffic from VLAN5 net to LAN net that is working. But if I try to add a printer using wizard in Win10 PC from VLAN5, it shows a printer in LAN and I can print.
How can I do?
Thanks in advance!

[Patrick M. Hausen]

Try to block from any to any UDP port 5353 in on VLAN5.

[fox983]

Same problem, printer is still there

[Patrick M. Hausen]

Please show the list of all rules on VLAN5.

[fox983]

1.
Action: Block
Interface: VLAN5
Direction: in
TCP/IP version: IPv4+6
Protocol: any
Source: VLAN5 net
Destination: LAN net

2.
Action: Pass
Interface: VLAN5
Direction: in
TCP/IP version: IPv4+6
Protocol: any
Source: VLAN5 net
Destination: any

[netnut]

The mdns responder that "Patrick M. Hausen" is referring to runs on the VLAN5 interface itself. Your first block rule blocks traffic towards LAN segment, not the firewall interface in VLAN5 where the service is running (which you allow in the second rule). Add a rule between the two you have with source VLAN5 network and destination VLAN5 interface port 5353.

[Patrick M. Hausen]

You need to block with destination any, because mDNS does not have destination LAN net.

I wrote what exactly to block in my last post.

[fox983]

Added between them or as first rule, same problem.

1.
Action: Block
Interface: VLAN5
Direction: in
TCP/IP version: IPv4+6
Protocol: UDP
Source: any
Destination: any
Destination port range: 5353 - 5353

[fox983]

Packet capture:
IPv4, length 76: 192.168.110.116.5353 > 224.0.0.251.5353: UDP, length 34


Live view:
action: [pass]
dir: [out]
dst: 192.168.110.116
dstport: 5353
interface_name: VLAN5
ipversion: 4
label: let out anything from firewall host itself
protoname: udp
reason: match
src: 192.168.199.76
srcport: 5353


This is probably the reason why it doesn't apply the rule from my previous post, because a pass rule is already set among the "Automatically generated rules". How can I block it?

[Patrick M. Hausen]

Are you running the UDP broadcast relay or the mDNS repeater on that VLAN5 interface?

[fox983]

None of them, they are not installed...

[netnut]

You need to block with destination any, because mDNS does not have destination LAN net.

I'm sorry for the confusion, assumed OP was running a mdns responder, either way "my" rule would never match....

But, printer discovery is in most cases broadcast or mdns (multicast) based, the former will never leave the subnet, for the latter you need to have some multicast routing in place. So it's weird you see the printer in the first place, and even if you did magicly discovered it, actually printing to it would match the VLAN to LAN block rule.

[fox983]

But this could not be the default behavior... How can I block it?

[Patrick M. Hausen]

Disable mDNS Repeater on the VLAN5 interface.

[fox983]

mDNS repeater is not installed.