firewall-start script VS web UI port forwarding

[Joel Teixeira]

Hey there,

I'm a little confused regarding port forwarding on my ASUS AC3200. I disabled uPnP since it seems to be related with some security concerns and mapped all ports manually. My main doubt is, do I need to use the firewall-start script if the rule is already on the "WAN - Virtual Server / Port Forwarding"?

If I create, for instance, a rule like:

Do I still need to open the ports on firewall-start with:

Or/And I should redirect using the firewall-star as well (not sure the syntax below is correct):

Is there any preferred method? When I create a redirect on Web UI it automatically open/forwards the port without needing to tweak with the script? Or the script is prefered and I shoud forget about the web UI when it comes to port forwaring?

Thanks a lot!

 

[ColinTaylor]

No you don't need any scripts.

 

[Martineau]

Or/And I should redirect using the firewall-star as well (not sure the syntax below is correct):

Or the script is prefered and I shoud forget about the web UI when it comes to port forwaring?

FYI To exploit the Port Forwarding tables implemented by Asus, the rules are in the following format:

iptables -t nat -I PREROUTING -d $(nvram get wan_ipaddr) -j VSERVER
iptables -t nat -I VSERVER -p udp -m udp --dport nnnnn -j DNAT --to-destination xxx.xxx.xxx.xxx:ppppp

Using a custom Port Forwarding script is useful in the following scenarios:

1. You exceed the Port forwarding rule limit in the GUI!

2. You wish to dynamically allow the Fort Forwarding only for a specific (limited) time period (using cron) or based on some other criteria/event such as port knocking etc.

 

[Joel Teixeira]

FYI To exploit the Port Forwarding tables implemented by Asus, the rules are in the following format:

iptables -t nat -I PREROUTING -d $(nvram get wan_ipaddr) -j VSERVER
iptables -t nat -I VSERVER -p udp -m udp --dport nnnnn -j DNAT --to-destination xxx.xxx.xxx.xxx:ppppp

Using a custom Port Forwarding script is useful in the following scenarios:

1. You exceed the Port forwarding rule limit in the GUI!

2. You wish to dynamically allow the Fort Forwarding only for a specific (limited) time period (using cron) or based on some other criteria/event such as port knocking etc.

Thanks a lot for the detailed explanation. Since I don't have so many rules to apply I'll just remove the firewall-start file completely.