Limit WAN to connect to only one domain

Installing and Using OpenWrt Network and Wireless Configuration
1

I am using GL-MT300-V2. I am using a Mobile Data dongle for WAN connection with the 2 Ethernet ports set as LAN. WiFi disabled.
I want to limit the WAN to connect only to one domain e.g. myownserver.co.uk , all other domains to be blocked.
On one LAN port is a Windows tablet PC and I only want one application to have Internet access to FTP data to server ( or via HTTP Post to the same server).

I would welcome advice on setting up suitable Firewall rules. Currently there is a default set of rules from the GL install

|Firmware Version|OpenWrt 19.07.7 r11306-c4a6851c72 / LuCI openwrt-19.07 branch git-21.044.30835-34e0d65|

2

Careful though, because you are trying to achieve the opposite thing than described in the guide.
You'll disable the lan->wan forwarding and the firewall rule will allow the traffic from lan to this specific domain.

1 Like
3

Thanks. I will take a look. As you say I am reversing this. But must stay positive!!

4

Struggling to get my head around this.
Would an alternate strategy be to only permit outgoing FTP traffic. Would this be easier to implement.

5

If you can use IPs instead of DNS names, then you can allow outgoing access to just that specific IP.

Alternatively allow the router to access DNSes for IP verification, to be able to update fw rule with new IP, when/if needed.

1 Like
6

Hi. I had the same problem and found this topic. This is solution I use (openwrt 23.05.0).

  1. Install pbr app ( luci-app-pbr). It will require to uninstall dnsmasq and install dnsmasq-full first. Refresh OpenWrt Web interface.
  2. Go to Services -> Policy Routing. Enable and start pbr if it is not running. Add new policy to required subnet and domain for wan. Save changes.
  3. Go to Status -> Routing and find IPv4 Rules created by pbr app. Find fwmark for pbr_wan.
  4. Go to Network -> Firewall and remove forwarding from LAN to WAN.
  5. Go to Network -> Firewall -> Traffic Rules tab and add new rule which will accept traffic from LAN to WAN with mark from step 3. Mark should be set in the Match mark field in Advanced Settings tab. Save changes.
    Maybe it will require to restart router.

It works but I am not shure if LAN hosts can set same mark to bypass the firewall on router.

7

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.