Firewall / block WAN connections to specific device

[RollingStar]

I have an insecure device I want to have LAN only access. I don't want anything outside my network talking to it or vice versa.

Does this work? I'm worried this still allows wan devices to send packets TO the insecure device. The "source" is the static local IP I set (192.x.y.z).

This seems to answer my question

Firewall question - how to block one device from WAN

network -> custom rules iptables -A forwarding_rule -m mac --mac-source xx:xx:xx:xx:xx:xx --jump REJECT restart firewall (status -> firewall -> restart firewall)

but the method is deprecated

21.02 > 22.03 - iptables custom rules migration

Apologies if this has been covered elsewhere. I did search the forum and the web but couldn't find answers that address my specific situation. I'm currently running 21.02 and have lots of custom iptables firewall rules, mostly for tagging connections/packets with DSCP marks, but sometimes in non-trivial ways devised over many months. Obviously at some point I will need to upgrade to 22.03, but I'm concerned about the switch from iptables to nftables and how much pain that's going to cause me. A…

More info here

Firewall rule to block device from accessing internet seems not working

Hi, In my firewall rules I set a test rule for device A with mac-addr XYZ to block internet access. These is the rule as it show in LUCI: Fowarded IPv4 and IPv6 From *lan*, MAC: XYZ To *wan* (Protocol any) Reject foward The device A has an update feature to fetch last release from github, so I try to get last update and it still was able to fetch it. What am I doing wrong here?

[lleachii]

You can simply remove the LAN to WAN forwarding rule.

• Edit LAN zone and delete WAN from "Allow forward to destination zones"
• (or delete LAN under WAN's "Allow forward from source zones")

[RollingStar]

Can I do this for a single device? Is this under Firewall - Port Forwards?

[lleachii]

@RollingStar

Is this under Firewall - Port Forwards?

It's under the General Firewall menu.

@RollingStar

Can I do this for a single device?

I'm unsure what you mean by this question. You'd be editing the zone rule.

[RollingStar]

This is what I have now.

I don't want to block/firewall traffic for every device in my network. I want one single phone on my network to be LAN only (no connections to or from outside my house). The other devices on my network (routed by openwrt) still need to connect to the internet.

[lleachii]

@RollingStar

I want one single phone on my network to be LAN only

You can do this under Traffic Rules - making a rule that blocks a single device from SRC LAN to DST WAN. Caveat, you can block by MAC (this might be random on the phone) or IP (likewise because the MAC rotates).

You would block All protocols - IPv4 (and IPv6). Your rule in the screenshot only blocks TCP and UDP, so I wanted to make note.

[RollingStar]

the phone is set to a static IP via MAC in openwrt, so the ip should be the same. under 'advanced settings' I also set the MAC. my "phone" is actually an old internet of things box, so no randomized MAC to worry about.

As I said:

I'm worried this still allows wan devices to send packets TO the insecure device.

Can packets still get through? Because the "phone" is likely vulnerable (unpatched) I don't want some malicious packets coming in and being parsed by the "phone".

My interpretation of my screenshot is it prevents data from being sent FROM the "phone" to the wide internet.

edit: It looks like it's working. When I SSH to the phone, it can't run

curl -v https://example.com

successfully.

When I "save changes" to include all protocols (not just TCP and UDP)

ping 1.1.1.1

stops working (good).

Thanks a ton!