Wan to Lan filter?

[IrishVillain]

I just bought a RT-N66U N900 device and I have most of my setup done however I want to restrict access to port forwarded ports.

e.g. I enable port foward for say 22 to a lan ip but only want to allow access from a specific public IP

I can't see how to do that, I can only see LAN to WAN filters?

 

[sinshiva]

So, i understand where you are coming from, but do know that this isn't remotely a foolproof method of security, even when filtering by MAC addresses.

if you still desire this, it can be done if you install asuswrt-merlin. you will need to format/enable JFFS. then you simply add the following to a file, /jffs/firewall-start

#!/bin/sh
iptables -t nat -A PREROUTING -p tcp -m tcp -s ALLOWEDIP -d `nvram get wan0_ipaddr` --dport PORTNUMBER -j DNAT --to LANIP

replace ALLOWEDIP, PORTNUMBER and LANIP accordingly. remove the old rule from the webui

 

[IrishVillain]

So, i understand where you are coming from, but do know that this isn't remotely a foolproof method of security, even when filtering by MAC addresses.

if you still desire this, it can be done if you install asuswrt-merlin. you will need to format/enable JFFS. then you simply add the following to a file, /jffs/firewall-start

#!/bin/sh
iptables -t nat -A PREROUTING -p tcp -m tcp -s ALLOWEDIP -d `nvram get wan0_ipaddr` --dport PORTNUMBER -j DNAT --to LANIP

replace ALLOWEDIP, PORTNUMBER and LANIP accordingly. remove the old rule from the webui

Thanks, it's not foolproof but it's a hell of a lot better than just having it open and relying on password!

I managed to get this done by editing iptables on the standard firmware

iptables -t nat -A VSERVER -p tcp -m tcp -s $ipRange/25 --dport 22 -j DNAT --to-destination 192.168.1.101:22

Just seems bizarre the system has a LAN to WAN filter but not WAN to LAN!

 

[sinshiva]

Thanks, it's not foolproof but it's a hell of a lot better than just having it open and relying on password!

I managed to get this done by editing iptables on the standard firmware

iptables -t nat -A VSERVER -p tcp -m tcp -s $ipRange/25 --dport 22 -j DNAT --to-destination 192.168.1.101:22

Just seems bizarre the system has a LAN to WAN filter but not WAN to LAN!

the problem with this is the rule won't persist across reboots. with asuswrt-merlin, there's various scripts and config overrides you can use, stored in JFFS. JFFS can be enabled for the official firmware, but it's only used as a storage location for logging, etc.