dd-wrt - limit access to machine from outside world

Question

In dd-wrt, can I limit access from the "outside world" to a single machine with a IP whitelist? So I want to allow access from a single "outside world" IP to a single machine on my network, and all other machines should accept calls from any outside caller.

Answer 1

dd-wrt allows the use of iptables. You can insert firewall commands in the dd-wrt GUI at: Administration->Commands->[enter commands in the text box->Save Firewall.

I stole, excuse me, quote, the following from the dd-wrt wiki:

Suppose I might want to add a rule so that I can ssh into my router from a specific host/address outside. Then I might type the following:

iptables -A INPUT -p tcp -s 150.100.whatever.something --dport 22 -j logaccept

So I am saying: Append to the INPUT chain a rule allowing protocol tcp, with a source address of traffic destined for port 22 on my router, jump to logaccept. I could have used -j ACCEPT which simply jumps to ACCEPT, but in this case I want to log it just to keep track so I use logaccept, which is a chain we have set up for this purpose.

Note: Simply adding a rule to the INPUT chain may be enough to allow remote SSH access from the WAN. However, if your router is still in NAT/Gateway mode and you wish to remap the SSH port to something less traditional on the WAN side (say port 2222), you may Insert a PREROUTING rule instead. This is actually how the GUI does it when you enable remote WAN SSH management.

iptables -A INPUT -p tcp -m tcp -d `nvram get lan_ipaddr` --dport 22 -j logaccept  
iptables -t nat -A PREROUTING -p tcp -m tcp -d `nvram get wan_ipaddr` --dport 2222 -j DNAT --to-destination `nvram get lan_ipaddr`:22

Answer 2

iptables rules are read in a chain, so whichever rule is met first is what is used. In my example, the rules are APPENDED to the bottom of the chain (via the -A option). Where you say you already forward port 22, I'm assuming you did that via the GUI, which is fine, and what the GUI does is simply to translate that into an iptables rule, which you can view with the command

iptables -vnL

which shows the full list of ip tables rules in place.

Regarding your second comment: iptables only applies when your traffic is crossing between the WAN and LAN parts of your router, meaning if your address is in the private range (192.168.x.x) then getting that delivered to the proper host on the LAN is done using the LAN interfaces only, whereas public addresses on packets originating in the LAN are automatically dumped to the WAN for delivery.

An interesting experiment you can run to test out this behavior is to try connecting to your internal host using an internal address, like 192.168.x.x:22, then, with port forwarding turned off for that port in the dd-wrt GUI, try to connect to your external IP address (find it by looking in the dd-wrt GUI) on that same port, like 76.54.999.257:22 (except use a real address of course). With port forwarding disabled, you will actually see that the internal connection works where the external doesn't.

You can tweak the behavior of what dd-wrt considers a WAN-side port and what is a LAN-side port using VLANs and such to actually logically group physical ports in strange ways, but that is beyond the scope of the question.