block access to wrt from vlan using iptables dd-wrt

Question

I set up multiple isolated vlans in dd-wrt. Now I need to forward a port to vlan2.

I isolated the vlans using:

iptables -I FORWARD -i br0 -o vlan2 -j DROP
iptables -I FORWARD -i br0 -o vlan3 -j DROP
iptables -I FORWARD -i br0 -o vlan4 -j DROP

Now I need to block a clients on each vlan from accessing the router.

This doesn't work:

iptables -I INPUT -i br0 -o vlan2 --dport telnet -j REJECT --reject-with tcp-reset

I'm new it iptables... am I missing something?

Answer 1

If you want the client to not access the router, you can't use -o. In addition, if you want to use --dport, you must specify the protocol. So, do it like this:

iptables -I INPUT -i br0 -p tcp --dport telnet -j REJECT --reject-with tcp-reset

-o is used only if you want to apply the rule to a packet passing the router.