ACL to forward WAN to LAN TRaffic

rosario.iameo · September 18, 2023, 10:59am

I would like to configure the device to allow only some hosts on the 10.0.2.0/24 network via IP or MAC to reach all on the 10.0.2.0/24 LAN.
can make all the hosts of the wan subnet communicate with the lan subnet but I don't understand how to implement an ACL.

You can help me?

lleachii · September 18, 2023, 11:10am

You didn't provide needed information (e.g. the WAN IP of the OpenWrt).

On the upstream device - Make a static route on the 10.0.1.0/24 router for 10.0.2.0/24 via <interface> gw 10.0.1.x

where x == the IP of the OpenWrt

Disable Masquerade on OpenWrt's WAN
Create traffic rules allowing traffic - as desired

or

Just make Port Forwards

rosario.iameo · September 18, 2023, 11:51am

This is my configuration

with a traffic rule

but all wan host can reach every lan host...

where is error?

vgaetera · September 18, 2023, 12:16pm

Edit your zone settings and disable zone-to-zone forwarding.