Question

I am trying to close port 22 to prevent access from external ips (wan/l2tp/vpn) but keep it open for the lan.

I added the following firewall rule:

config rule
option name 'Block-WAN-to-LAN-port-22-traffic'
option src 'wan'
option dest '*'
option dest_port '22'
option proto 'tcp'
option target 'REJECT'
option enabled '1'
 

However an nmap scan from an external vps shows the port is still open.  I think other firewall settings are factory defaults.

What am I doing wrong?

paul

Answer 1

Hi,

Try blocking port 22 in WebUI.

First head to Network > Firewall then Traffic Rules.

• Find a rule called: Enable_SSH_WAN
• Edit it and make sure it's set-up like this:

After you save it you should have your 22 port blocked from WAN. You can do the same for different zones with new rules (VPN, LAN and etc.).

If you're still having troubles making this work make sure there are no other rules overriding each other, restart your router and see if that changes anything.

EB.

Comments

thanks EB

Rejecting on l2tp worked for my use case.  Added a new rule for the wan as well.