[ASUSWRT-MERLIN] Web interface OFF, but still showing

[Rahlzel]

Router: RT-N66U
Firmware: AsusWRT-Merlin 380.58_0 (20-Mar-2016)

I've tried enabling/disabling the Enable Web Access setting to "reset" it. No go. I think it's also important to note that this was happening back when I was using v374 of the firmware as well. Should I try a factory reset?

 

[pete y testing]

I've tried enabling/disabling the Enable Web Access setting

now are you accessing this from within your own lan or when connected to an external internet source as it may be nat loop back at play here

 

[Rahlzel]

Oops. You're right. I connected to my VPN and then tried to connect to my IP address: "This site can't be reached."

EDIT: Nevermind. Disabling NAT Loopback creates more problems than it solves. Thanks!

 

[pete y testing]

I'd prefer to see what everyone on the outside sees -

then just connect from your phone using 3g/4g and see what it responds with

it

How do I disable NAT Loopback?

looks like its disabled

are you sure the ip address you are using is a wan side address

 

[osi]

I can confirm this is an issue. I came to the forums to see if others have the problem. I upgraded from an older version and it too had the same problem.

The "Enable Web Access from WAN" feature technically works--it opens up passthrough to router via WAN IP and port 8080.

However, whether "Enable Web Access from WAN" is enabled or not, passthrough is allowed via WAN IP on port 80 to the router config page.

My modem is a zoom 5341j for reference.

 

[Rahlzel]

But because of NAT Loopback, it only shows up to you and not to anyone else. That's what I was worried about when I reported this. If you have a VPN or a cell phone with Wifi turned off, try connecting to your external IP to see if the router login page shows up.

 

[osi]

But because of NAT Loopback, it only shows up to you and not to anyone else. That's what I was worried about when I reported this. If you have a VPN or a cell phone with Wifi turned off, try connecting to your external IP to see if the router login page shows up.

I confirmed with cell phone when I tried hitting my WAN IP from my laptop and was shocked when the page actually resovled-- and YES, the page is still accessible from celluar network. Also I have no VPN setup on the router so we can rule that out.

 

[osi]

I just flashed back to ASUS firmware. I have a RT-N66U and it has ASUS version 3.0.0.4.378.9529.

The same bug (maybe feature) plagues the official firmware as well. There is a beta version 9.0.0.4.380.2695 with a clip from patch notes :

"Restriced access from wan method to enhance security. (Thanks for David)".

I'm flashing this version now to test.

 

[osi]

The beta release 9.0.0.4.380.2695 has corrected the exposed interface being accessed by external ip or WAN ip. The interface seems dog slow but I'm sure that will be ironed out when it's officially rolled out.

Maybe we'll see it rolled into merlin soon.

 

[Zirescu]

I confirmed with cell phone when I tried hitting my WAN IP from my laptop and was shocked when the page actually resovled-- and YES, the page is still accessible from celluar network. Also I have no VPN setup on the router so we can rule that out.

Are you sure your Firewall is enabled? Have you also run a Common Ports ShieldsUp! check?

 

[osi]

Are you sure your Firewall is enabled? Have you also run a Common Ports ShieldsUp! check?

Will confirm firewall tomorrow and test.

Hopefully it's as simple as that

 

[osi]

Confirmed the setting the "Enable Firewall" option to 'YES' will indeed close this port up.

No worries here for now. I'm more surprised that by default, the router is WAN accessible if the modem permits.

Thanks Zirescu

 

[jeff288]

This is kind of old news and a confirmed issue. It probably needs to be reiterated that with the firewall off, you can access the router from the WAN regardless of the setting. There was a thread last month with an article linked calling it a security issue while some were calling it a user issue. Personally I don't expect the average user to know this so I consider it a security issue. It's good they decided to fix this.