OpenWrt Forum Archive

Topic: access router from Internet (wan)

The content of this topic has been archived on 30 Mar 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Post #1
scimmia29
8 Apr 2011, 08:42

I have a tp-link with wr1043nd with Openwrt Kamikaze (r24038) with LuCI interface.
I wish I could access the configuration page of my router from outside (Internet), but I have some "small" problem: I installed the package luci-app-ddns and I configured the service with dyndns.org ... works great ... then in the menu Network -> Firewall -> Traffic Control I created a new entry defined as:
NAME: prova
Protocol: TCP
SOURCE: wan: 0.0.0.0 / 0:80
DESTINATION: lan: 192.168.0.1:80
ACTION: ACCEPT
but I can not access from outside the router's configuration page ... but if I go to Network -> Firewall -> Zones and change the default policy of the Incoming Traffic of WAN fromt Reject to Accept ... everything works. .. how can I block all incoming traffic from the WAN except for the port 80 that I need? I am attaching my firewall configuration:

config 'defaults'
    option 'syn_flood' '1'
    option 'input' 'ACCEPT'
    option 'output' 'ACCEPT'
    option 'forward' 'REJECT'

config 'zone'
    option 'name' 'lan'
    option 'input' 'ACCEPT'
    option 'output' 'ACCEPT'
    option 'forward' 'REJECT'

config 'zone'
    option 'name' 'wan'
    option 'output' 'ACCEPT'
    option 'forward' 'REJECT'
    option 'masq' '1'
    option 'mtu_fix' '1'
    option 'input' 'REJECT'

config 'forwarding'
    option 'src' 'lan'
    option 'dest' 'wan'
    option 'mtu_fix' '0'

config 'rule'
    option 'src' 'wan'
    option 'proto' 'udp'
    option 'dest_port' '68'
    option 'target' 'ACCEPT'

config 'rule'
    option 'src' 'wan'
    option 'proto' 'icmp'
    option 'icmp_type' 'echo-request'
    option 'target' 'ACCEPT'

config 'include'
    option 'path' '/etc/firewall.user'

config 'rule'
    option 'target' 'ACCEPT'
    option '_name' 'prova'
    option 'src' 'wan'
    option 'dest' 'lan'
    option 'proto' 'tcp'
    option 'src_port' '80'
    option 'dest_port' '80'
    option 'dest_ip' '192.168.0.1'

sorry for my language, but I'm Italian

(Last edited by scimmia29 on 8 Apr 2011, 08:43)

Post #3
buffl
8 Apr 2011, 10:15

so you have a redirection is disabled

        option 'forward' 'REJECT'

and if that does redirects?

(Last edited by buffl on 8 Apr 2011, 10:25)

Post #4
jow
8 Apr 2011, 10:59

buffl, remove the source_port, it is never 80 and always dynamic for a simple client connection.

The discussion might have continued from here.