Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to follow this guide and I have a simple request that I haven't been able to solve. I'd like to only accept requests from a specific IP address to a host within my internal network at home. The router is using DD-WRT v24-sp2 (04/15/13) std - build 21286. I know this can be configured in the GUI, however I need to update these rules via script so I need to run iptables commands.

I did try to set a single IP address as the "source net" in the port forwarding gui and it doesn't work. It will only work if that source net field is left blank.

From Internet IP: 123.123.123.123

Internal Host IP: 192.168.1.111 Internal Host Port: 5555 (TCP)

These rules work:

iptables  -t nat -I PREROUTING -p tcp -d $(nvram get wan_ipaddr) --dport 5555 -j DNAT --to 192.168.1.111:5555
iptables -I FORWARD -p tcp -d 192.168.1.111 --dport 5555 -j logaccept

These do not:

iptables  -t nat -I PREROUTING -p tcp -s 123.123.123.123 -d $(nvram get wan_ipaddr) --dport 5555 -j DNAT --to 192.168.1.111:5555
iptables -I FORWARD -p tcp -s 123.123.123.123 -d 192.168.1.111 --dport 5555 -j log
share|improve this question

1 Answer 1

I found out that these rules actually do work. The source IP on the FORWARD rule is not necessary and I was attempting to access an IP in my own network so I was substituting my WAN IP for 123.123.123.123 when I should have added my internal 192.168.1.1/24 network to the rule.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.