Lame question: how to manage firewall settings on RT-AX?

[user_20240830]

It is clearly stated how to enable firewall on wireless routers. Is there any REALLY hardcore way out of GUI? Any hints to fine adjust RT-AX series firewall will be greatly appreciated!

 

[ColinTaylor]

Look at the Skynet addon script.

Skynet - Skynet - Router Firewall & Security Enhancements

For support requests and questions please use the Github Issue Tracker where this script is actively maintained Skynet - Router Firewall & Security Enhancements Elevate your home network security with Skynet, a robust firewall and security tool meticulously crafted for ASUS routers running...

www.snbforums.com

Skynet - New Skynet 7.6.5 Release

Edit New Release 7.6.5, see post #157 Edit New Release 7.6.4, see post #149, #150, #153 Edit New Release 7.6.3, see post #145 Edit New Release 7.6.2, see post #144 Edit New Release 7.6.1, see post #135 Edit New Release 7.6.0, see post #134 Edit New Release 7.5.9, see post #113 Edit New...

www.snbforums.com

Alternatively, write your own iptables rules and put them in a firewall-start user script.

You can also use the router's Network Services Filter but that only controls LAN to WAN traffic, not unsolicited incoming traffic.

P.S. Please remove the Tutorial prefix from your title as you are not publishing a tutorial.

 

[bennor]

It is clearly stated how to enable firewall on wireless routers. Is there any REALLY hardcore way out of GUI? Any hints to fine adjust RT-AX series firewall will be greatly appreciated!

In addition to what's @ColinTaylor said about iptables, use the forum search feature if you haven't done so already. Lots of past discussion and examples on iptables and using firewall-start code/scripts.

It may help if you explain what it is you are looking to do with fine adjustments to the firewall. Others may be able to offer more suggestions.

Usual word of caution here. Incorrectly making a firewall modification or change can lead to unexpected firewall operation, and may potentially open up the router or clients on the local network behind the firewall being compromised or being visible to the entire internet. This is one of those times were you proceed at your own risk.

PS: And see the Addon Catalogue for more. May be something there in addition to the aforementioned Skynet that may do what you are seeking to accomplish.

Asuswrt-Merlin Addon Software Catalog

Asus-Merlin Addon Software Catalog This sticky post functions as a software catalog (with links to threads, scripts, and author names), grouped by functionality, to make it easier for Asus-Merlin users to find and install addons for their Asus routers without having to search through massive...

www.snbforums.com

 

[user_20240830]

In addition to what's @ColinTaylor said about iptables, use the forum search feature if you haven't done so already. Lots of past discussion and examples on iptables and using firewall-start code/scripts.

It may help if you explain what it is you are looking to do with fine adjustments to the firewall. Others may be able to offer more suggestions.

Asuswrt-Merlin Addon Software Catalog

Asus-Merlin Addon Software Catalog This sticky post functions as a software catalog (with links to threads, scripts, and author names), grouped by functionality, to make it easier for Asus-Merlin users to find and install addons for their Asus routers without having to search through massive...

www.snbforums.com

Thank you for giving a search hint. It totally unleashed the results on the subject! My initial goal was to limit WAN access for ancient NAS which has completely obsolete software in terms of SMB, FTP and NFS protocols. It couldn't be seen only from my devices due to 'smb' older that 0.9-something version and rest of it communicates only using 'HTTP' instead. Additionally I have media-player with Android 11 onboard. That is supposed to be continuously re-adjusted by VPN to access all media sources across the Globe. And there's finally an Android(ver.10) TV with Google Assistant onboard which has voice capability to be supervised by user (hardware switch OFF by hand).

 

[bennor]

My initial goal was to limit WAN access for ancient NAS which has completely obsolete software in terms of SMB, FTP and NFS protocols.

Blocking full WAN access (if that is what you are seeking) per client should be easily achievable for main LAN clients by using the Parental Controls > Time Scheduling > Enable Time Scheduling then using the Block option when adding the ancient NAS to the Client List. The other way to block the client is through the Network Map > Client Status, click on the client then in the popup dialog box click Block Internet Access. In both cases make sure to hit the Apply button to apply the block on the client. Example's attached showing each way of blocking WAN to a NAS wired to the main router (RT-AX86U Pro w/ 3006.102.5 firmware). In the attached example I am blocking WAN access to a old single bay v4.x My Cloud NAS unit that WD themselves recommends blocking internet access to.