What's new

Allowing just one device to subnet (iptables or Network Services Filter?)

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!


Regular Contributor
Due to my ISP forcing me to use their router if I want to use their bundled VOIP service, since upgrading to FTTP I now have to have my ASUS sitting behind my ISP's router. Annoyingly they don't allow their router to run in a bridged mode.

As much as I can I have tried to make it a native bridge mode, by turning off all WiFi radios and the firewall on the ISP router; turning off its DHCP server; connecting only the ASUS router to the ISP router via ethernet and assigning it a static IP; using a static IP for the ASUS WAN interface and the ISP router as its gateway; placing the ASUS router in the ISP router's DMZ; and also forwarding all TCP&UDP ports (1:65535) from the ISP router to the ASUS.

This seems to work fine. Despite technically being in a Double-NAT, it is functionally working as close as possible to a direct connection, and I can even access the ASUS' OpenVPN server when remote, all whilst being able to continue using the ISP's bundled VOIP.

However, I would like to only allow my own, one device, access to the ISP router's admin page, and none of my family's devices on the LAN. The ISP router is on the subnet, whilst the LAN's subnet from the ASUS DHCP server is

I'm sure there is a way of achieving this using the ASUS firewall, but I'm not sure of the best method. I was thinking to use the Firewall's Network Services Filter deny list from the GUI, with the ISP router's address as the destination, but then it seems I would have to enter every device that isn't my own. Is there a way of using the Deny List but using a not condition? e.g. Deny ! -> ? I'm, guessing the best thing would be to use a manual iptables rule entered in the cli, but I'm not sure of the best way of doing that on merlin. Any help would be appreciated.
Last edited:

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!