Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In dd-wrt, can I limit access from the "outside world" to a single machine with a IP whitelist? So I want to allow access from a single "outside world" IP to a single machine on my network, and all other machines should accept calls from any outside caller.

share|improve this question
up vote 2 down vote accepted

dd-wrt allows the use of iptables. You can insert firewall commands in the dd-wrt GUI at: Administration->Commands->[enter commands in the text box->Save Firewall.

I stole, excuse me, quote, the following from the dd-wrt wiki:

Suppose I might want to add a rule so that I can ssh into my router from a specific host/address outside. Then I might type the following:

iptables -A INPUT -p tcp -s 150.100.whatever.something --dport 22 -j logaccept

So I am saying: Append to the INPUT chain a rule allowing protocol tcp, with a source address of traffic destined for port 22 on my router, jump to logaccept. I could have used -j ACCEPT which simply jumps to ACCEPT, but in this case I want to log it just to keep track so I use logaccept, which is a chain we have set up for this purpose.

Note: Simply adding a rule to the INPUT chain may be enough to allow remote SSH access from the WAN. However, if your router is still in NAT/Gateway mode and you wish to remap the SSH port to something less traditional on the WAN side (say port 2222), you may Insert a PREROUTING rule instead. This is actually how the GUI does it when you enable remote WAN SSH management.

iptables -A INPUT -p tcp -m tcp -d `nvram get lan_ipaddr` --dport 22 -j logaccept  
iptables -t nat -A PREROUTING -p tcp -m tcp -d `nvram get wan_ipaddr` --dport 2222 -j DNAT --to-destination `nvram get lan_ipaddr`:22
share|improve this answer
sweet! thanks! – SFun28 Jun 28 '11 at 2:15
just wondering, if I already have port-forwarding enabled for the opened port (22 in your example), then which rule "wins"? Will the iptables rule block unwanted IP addresses and then port forwarding will forward the requests from whitelist IPs? – SFun28 Jun 28 '11 at 13:53
also...iptables doesn't limit my ability to connect to the restricted ports via the intranet does it? – SFun28 Jun 28 '11 at 14:00
Posting a new answer to respond – queso Jun 29 '11 at 0:00

iptables rules are read in a chain, so whichever rule is met first is what is used. In my example, the rules are APPENDED to the bottom of the chain (via the -A option). Where you say you already forward port 22, I'm assuming you did that via the GUI, which is fine, and what the GUI does is simply to translate that into an iptables rule, which you can view with the command

iptables -vnL

which shows the full list of ip tables rules in place.

Regarding your second comment: iptables only applies when your traffic is crossing between the WAN and LAN parts of your router, meaning if your address is in the private range (192.168.x.x) then getting that delivered to the proper host on the LAN is done using the LAN interfaces only, whereas public addresses on packets originating in the LAN are automatically dumped to the WAN for delivery.

An interesting experiment you can run to test out this behavior is to try connecting to your internal host using an internal address, like 192.168.x.x:22, then, with port forwarding turned off for that port in the dd-wrt GUI, try to connect to your external IP address (find it by looking in the dd-wrt GUI) on that same port, like 76.54.999.257:22 (except use a real address of course). With port forwarding disabled, you will actually see that the internal connection works where the external doesn't.

You can tweak the behavior of what dd-wrt considers a WAN-side port and what is a LAN-side port using VLANs and such to actually logically group physical ports in strange ways, but that is beyond the scope of the question.

share|improve this answer
excellent writeup across-the-board! So what procedure would I use to whitelist an external IP for a request made to a port and then port-forward to a machine on my network? In otherwise, I'm saying its ok for to talk to my router on port y and when it does, I forward to internal ip zzz.zzz.zzz.zzz? Perhaps append iptables whitelist line from your original post ABOVE the gui-generated port-forward? is that even possible? Or maybe remove the gui-generated line and just add two iptables lines - one for whitelist and second for port-forward? – SFun28 Jun 29 '11 at 4:32
Either way would work. All the GUI does is add iptables rules anyway, so the result would be the same. You might try figuring out how to do it all from iptables commands as that will make you more 1337, and that's part of the whole point anyway, right? – queso Jul 12 '11 at 2:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .