If multiple LAN networks are configured, by default no communication is possible between these networks. This article explains how you can allow traffic between LAN networks, also called LAN to LAN.

Configure LAN to LAN access

Follow the steps below to enable communication between LAN networks.

1. Connect locally to one of the LAN ports of the edge gateway or set up a VPN connection.
   • The local web interface is not accessible from the WAN side (Cloud port and also OT/LAN port when it's configured as WAN2).
2. Open a new browser tab, go to the edge gateway's LAN IP address, and log in.
   • The default LAN IP address is 192.168.140.1.
   • If you're connecting locally, make sure that your laptop has an IP address in the same range. You may need to configure this manually. There are many online guides on this if you need a step by step guide.
   • The default username is admin.
   • The default password (PW) is printed on the side of the edge gateway.
   • The number of login attempts is limited per time window, in compliance with cybersecurity standard IEC 62443-4-2. By default, the number of login attempts is limited to 5 per 1 minute, replenishing a login attempt every 1 minute. We recommend you configure this to align with your corporate security policy. Do so by logging in and going to Administration > Authentication.
   • You can change the password by logging in and going to Administration > Change password.
3. Go to Network > Firewall > LAN firewall.
4. ClickAdd entry, enter the requested information (details below), and click on Submit changes.

   Field	Description
   Source IP address / CIDR*	The source LAN network's IP range (CIDR notation) or an individual device's IP address or leave empty to allow traffic from all sources. CIDR notation example: Network 192.168.140.0 with subnet mask 255.255.255.0 in CIDR notation is 192.168.140.0/24.
   Source MAC address*	The source device's MAC address.
   Protocol	Select a protocol to allow or select all to allow all protocols.
   Destination IP address / CIDR*	The destination LAN network's IP range (CIDR notation) or leave empty to allow traffic to all destinations. Hostnames are not supported.
   Destination port	This field is only available if a protocol is selected. Enter the allowed port. Multiple ports or port ranges are not supported. To allow multiple ports, add a rule for each port.

   * A source IP address / CIDR, source MAC address, or destination IP address / CIDR is required.

5. Repeat these steps for each source - destination combination.
   • For example, to allow access from LAN network A to LAN network B and also from LAN network B to LAN network A, add 2 rules: one for A to B and another for B to A.