Allow access to VPN (PPTP) only from specific public IPs and general security questions

[Matwic]

I have a basic knowledge of iptables and practically no idea how asuswrt hadles the routing / firewalling / security.

1. I installed asuswrt-merlin (380.57) on RT-AC87U and would like to setup a VPN (PPTP) server to only allow incoming connections from a specific ip/ip ranges and drop all others. A sample firewall-start script would be greatly appreciated.

2. default iptables rules seems to be a bit of a mess (default settings, VPN enabled):

Chain INPUT (policy ACCEPT)
target     prot opt source        destination
DROP       icmp --  anywhere      anywhere      icmp echo-request
DROP       all  --  anywhere      anywhere      state INVALID
ACCEPT     all  --  anywhere      anywhere      state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere      anywhere      state NEW
ACCEPT     all  --  anywhere      anywhere      state NEW
ACCEPT     udp  --  anywhere      anywhere      udp spt:bootps dpt:bootpc
ACCEPT     icmp --  anywhere      anywhere      icmp !echo-request
ACCEPT     tcp  --  anywhere      anywhere      tcp dpt:1723
ACCEPT     gre  --  anywhere      anywhere
DROP       all  --  anywhere      anywhere

Wouldn't these allow any incoming connections to be accepted? And if not, how is port forwarding handled? If I forward a port should't there be an associated rule in the INPUT chain?

3. Where is Guest-Wifi isolation handled? (the rules so the guest-wifi cant access other LAN clients)? I would like to change these rules so even Guest-Wifi clients can connect to the DHCP and DNS services (and only those services) on a local server (Windows server).

 

[ColinTaylor]

I think part of your problem is that you are not seeing all of the iptables information, like which interface the rules apply to or the nat/mangle chains.

Try using iptables-save to see all the rules in a "raw" format.

 

[ColinTaylor]

There was a similar question about restricting access by IP address here: http://www.snbforums.com/threads/restrict-pptp-access-lan-access.29175/#post-232117

 

[RMerlin]

iptables -L -v