Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a OpenWRT installation which I'm currently hardening. I'd like to prevent all network access from LAN devices to the router, except for TCP 22, TCP 80, and TCP 443.

I'm using LuCI, and here are the general settings:

Here are the traffic rules:

Presently, all incoming traffic from the WAN is rejected except for remote TCP 22, TCP 80, and TCP 443. However, it would appear that all traffic from the LAN to the router is accepted.

How can I (safely) reject all traffic from the LAN to the router except for TCP 22, 80, and 443?

share|improve this question

Why not simply disable all other services - if there's no listener, there's no reason to block the port. And if your intention is to block the ports on both the LAN and WAN, there's no reason to run the deamons at all.

Also, FWIW you shouldn't run SSH (or any administrative UI/access point) on the default ports on the WAN side unless you want to get brute-forced constantly.

share|improve this answer
Not using passwords for authentication, only using public key authentication. There's not much to brute force there, and root account is disabled. – Naftuli Tzvi Kay Dec 4 '13 at 22:17
Fair enough, if it was me I'd still change the default ports so your router doesn't have to waste CPU cycles rejecting the attempts. – jlehtinen Dec 4 '13 at 22:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.