Option to disable wirless login?

[Jack Yaz]

Thanks @ColinTaylor You got the fix. Here are the steps I used to make it work on RT-AC88U:

ASUSWRT-Merlin RT-AC88U 380.70-0 Sun Apr  8 18:06:08 UTC 2018
router@asus:/tmp/home/root# nano /jffs/scripts/firewall-start
#Source: https://www.snbforums.com/threads/option-to-disable-wirless-login.47786/page-3#post-418798
ebtables -D INPUT -i eth1 -p ip4 --ip-protocol tcp --ip-destination $(nvram get lan_ipaddr) --ip-destination-port 80 -j DROP
ebtables -I INPUT -i eth1 -p ip4 --ip-protocol tcp --ip-destination $(nvram get lan_ipaddr) --ip-destination-port 80 -j DROP
ebtables -D INPUT -i eth2 -p ip4 --ip-protocol tcp --ip-destination $(nvram get lan_ipaddr) --ip-destination-port 80 -j DROP
ebtables -I INPUT -i eth2 -p ip4 --ip-protocol tcp --ip-destination $(nvram get lan_ipaddr) --ip-destination-port 80 -j DROP

router@asus:/tmp/home/root# nvram get gmac3_enable
1
router@asus:/tmp/home/root# nvram get fwd_wlandevs
eth2
router@asus:/tmp/home/root#

#setting stop_gmac3=1
router@asus:/tmp/home/root# nvram set stop_gmac3=1
router@asus:/tmp/home/root# nvram commit
router@asus:/tmp/home/root# reboot

#after reboot
router@asus:/tmp/home/root# nvram get gmac3_enable
0

router@asus:/tmp/home/root# ebtables -t filter -L --Lmac2 --Lc --Ln
Bridge table: filter

Bridge chain: INPUT, entries: 2, policy: ACCEPT
1. -p IPv4 -i eth2 --ip-dst 192.168.0.1 --ip-proto tcp --ip-dport 80 -j DROP , pcnt = 14 -- bcnt = 840
2. -p IPv4 -i eth1 --ip-dst 192.168.0.1 --ip-proto tcp --ip-dport 80 -j DROP , pcnt = 16 -- bcnt = 960

Bridge chain: FORWARD, entries: 0, policy: ACCEPT

Bridge chain: OUTPUT, entries: 0, policy: ACCEPT
router@asus:/tmp/home/root#

I will try to find what 3GMAC mode is.
Thank you all a lot!

Found this: https://www.snbforums.com/threads/r...-fa-nat-acceleration.27611/page-2#post-250055

 

[sfx2000]

IMHO - this is a tempest in a teacup - a lot of these recommendations and suggestions will break other things inside the router, and ultimately end up with another thread asking as to why things do not work.

Here's my suggestion - set a strong password, enable HTTPS on the Asus WebUI, and you're done...

simple enough

 

[RMerlin]

IMHO - this is a tempest in a teacup - a lot of these recommendations and suggestions will break other things inside the router, and ultimately end up with another thread asking as to why things do not work.

Here's my suggestion - set a strong password, enable HTTPS on the Asus WebUI, and you're done...

simple enough

Especially as it has brute force protection.

Sent from my P027 using Tapatalk

 

[cooloutac]

Especially as it has brute force protection.

Sent from my P027 using Tapatalk

or assume password will be compromised at some point and keep changing it.

Disable wireless gui login so people can't exploit your router or connections willy nilly with any device they want.

 

[RMerlin]

or assume password will be compromised at some point and keep changing it.

Disable wireless gui login so people can't exploit your router or connections willy nilly with any device they want.

Keep in mind that an increasing amount of people no longer have any wired devices and only have wireless ones. This means that fewer and fewer people would even be able to use such a setting. I've had customers who had only Macbooks and iPads at home for example, which meant they had no Ethernet devices at all on their network.

 

[sfx2000]

Especially as it has brute force protection.

Yep - and it's probably word to the wise to logout of WebGUI once any work is done - wired or wireless - don't need any spurious browser bugs happening there.

Going with this thread - always good to keep the threat surface at a minimum - esp. on WAN facing items, and even inside, take a close look at the services offered internally.