AsusWRT Merlin iptables

[EarlGrey]

Hello there!

I have several (smarthome) devices that phone home while that is not necessary due to local integration. To block devices from accessing the internet I usually use the 'Block Internet Access' function in the GUI.

It seems this function uses DROP to block access. The smarthome devices do not like this approach which results in disconnects. Using REJECT should solve this problem, that's why I created custom iptables rules (/jffs/scripts/firewall-start). The problem is, they do not work. Could someone have a look what I'm missing here?

iptables -A FORWARD -s 10.0.0.69 -o lo -j ACCEPT
iptables -A FORWARD -s 10.0.0.69 -d 10.0.0.0/24 -j ACCEPT
iptables -A FORWARD -s 10.0.0.45 -o lo -j ACCEPT
iptables -A FORWARD -s 10.0.0.45 -d 10.0.0.0/24 -j ACCEPT
iptables -A FORWARD -s 10.0.0.69 -j REJECT
iptables -A FORWARD -s 10.0.0.45 -j REJECT

 

[ColinTaylor]

Router model? Firmware version?

My guess is that you need to insert the rules at the beginning of the forward chain. At the moment you are appending them after the final accept.

 

[dave14305]

What is the purpose of the rules accepting connections to the loopback interface (-o lo)?

 

[EarlGrey]

Router model? Firmware version?

My guess is that you need to insert the rules at the beginning of the forward chain. At the moment you are appending them after the final accept.

Apologies, that would be an Asus RT-AC68U with firmware 384.16. Could you please elaborate how to append these rules at the beginning of the forward chain?

What is the purpose of the rules accepting connections to the loopback interface (-o lo)?

I was lead by the following source https://unix.stackexchange.com/questions/396218/block-wan-access-allow-lan-access-linux-hosts

 

[ColinTaylor]

Apologies, that would be an Asus RT-AC68U with firmware 384.16. Could you please elaborate how to append these rules at the beginning of the forward chain?

Use insert (-I) instead of append (-A). But I would only use the REJECT rules and leave the others out.

I was lead by the following source https://unix.stackexchange.com/questions/396218/block-wan-access-allow-lan-access-linux-hosts

That's not a particularly good example to copy because they are talking about the firewall on a host, not the gateway device.