Major Security Problem

[dmillerzx]

Apparently this has been the case since day one. Although I just noticed this. My router is both accessible on ports 80 and 22 by default even though the settings are configured as disabled. I did do a complete reset after upgrading firmware...

Enable Web Access from WAN = OFF
Enable SSH Access from WAN = OFF

Yet this is clearly not the case.... Is this a bug with my firmware version?

Bootloader (CFE) 1.0.1.3 (manual upgrade)

Firmware Version 3.0.0.4.354.28

Please advise. Thank you, in advance!

 

[RMerlin]

Apparently this has been the case since day one. Although I just noticed this. My router is both accessible on ports 80 and 22 by default even though the settings are configured as disabled. I did do a complete reset after upgrading firmware...

Enable Web Access from WAN = OFF
Enable SSH Access from WAN = OFF

Yet this is clearly not the case.... Is this a bug with my firmware version?

Bootloader (CFE) 1.0.1.3 (manual upgrade)

Firmware Version 3.0.0.4.354.28

Please advise. Thank you, in advance!

Please define "clearly not the case" since for me, it is "clearly the case" - neither 80 or 22 are accessible over the WAN. Are you testing from outside your LAN? Tests from inside are meaningless since they bypass the firewall.

 

[Pericynthion]

Also based on the other thread - if you have disabled the firewall, then all ports will be accessible(?)

 

[dmillerzx]

Sorry if I was not clear.

I have my firewall disabled. However; both SSH and Web admin are set to disabled access over WAN (can send a screen shot if you'd like)

I am a computer engineer so yes obviously doing this within my LAN is pointless. I am at work and have been able to log into my router's web gui and SSH using my home global IP.

Something is not right here. I don't believe having the built in firewall disabled should be allowing this...

 

[dmillerzx]

From looking at the other post I suppose I do need to have the firewall enabled. My apologies.

I'll enable this and confirm. The implementation by ASUS is misleading. Even with the firewall disabled you can toggle the access in administration.

Thanks guys.

 

[RMerlin]

From looking at the other post I suppose I do need to have the firewall enabled. My apologies.

I'll enable this and confirm. The implementation by ASUS is misleading. Even with the firewall disabled you can toggle the access in administration.

Thanks guys.

What the option to allow WAN access does is open the port in the firewall. That must be where the confusion came from - it doesn't actually control interface binding (the httpd daemon for starter doesn't support binding to specific interfaces, as it's a fairly cut-down httpd server).