iptables FORWARD and NSFW

[frequenzy]

Hi,

Currently using Asus Merlin on AC68U. If I want to block a specific IP and port via iptables, should it be inserted on FORWARD or NSFW?

on FORWARD
iptables -I FORWARD -s 1.1.1.1/32 -i br0 -o vlan2 -p tcp -m tcp --dport 853 -j DROP

on NSFW
iptables -I NSFW -s 1.1.1.1/32 -i br0 -o vlan2 -p tcp -m tcp --dport 853 -j DROP

Also for the jffs/scrips, should I insert the line on nat-start or firewall-start?

 

[RMerlin]

Use FORWARD, INPUT or OUTPUT. NSFW is a chain used by the webui-managed Network Service Firewall, I don't recommend manually messing with it.

Anything changed in the filter table should go to firewall-start, and the mangle/nat tables should go in the nat-start script.

 

[frequenzy]

Thanks RMerlin for the guidance.

 

[ColinTaylor]

If your objective is to stop clients accessing Cloudflare's DoT servers then I suggest that you use the Network Services Filter as that will create the rules for you. As it stands your command won't work because you have specified 1.1.1.1 as the source address instead of the destination.