0

I have a OpenWRT installation which I'm currently hardening. I'd like to prevent all network access from LAN devices to the router, except for TCP 22, TCP 80, and TCP 443.

I'm using LuCI, and here are the general settings:

Here are the traffic rules:

Presently, all incoming traffic from the WAN is rejected except for remote TCP 22, TCP 80, and TCP 443. However, it would appear that all traffic from the LAN to the router is accepted.

How can I (safely) reject all traffic from the LAN to the router except for TCP 22, 80, and 443?

1 Answer 1

1

Why not simply disable all other services - if there's no listener, there's no reason to block the port. And if your intention is to block the ports on both the LAN and WAN, there's no reason to run the deamons at all.

Also, FWIW you shouldn't run SSH (or any administrative UI/access point) on the default ports on the WAN side unless you want to get brute-forced constantly.

2
  • Not using passwords for authentication, only using public key authentication. There's not much to brute force there, and root account is disabled. Dec 4, 2013 at 22:17
  • Fair enough, if it was me I'd still change the default ports so your router doesn't have to waste CPU cycles rejecting the attempts.
    – jlehtinen
    Dec 4, 2013 at 22:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .