I have a TP-Link ER605 connected to my Comcast Business router. The firewall on the Comcast router is set up and working fine. Unfortunately, the TP-Link's ACL is either missing something or configured incorrectly. I have been working with firewalls and ACLs for my servers online with AWS, Linux, and Windows. Still learning, but this one has me stuck.
The goal of this firewall is to block everything except HTTP, HTTPS, and UDP DNS - both input and output.
THE PROBLEM
If I delete BLOCK_REMAINING, I can connect to the internet. I do not want to delete that, of course. This method has worked for me (blocking both input and output, with ports 1024-65535 and http protocols only) on other operating systems and in AWS.
EXPLANATION
THIS_ROUTER = the TP-Link router (192.168.0.1). WORKSTATIONS are the individual IPs of the allowed computers on the network. ALL_SUBNETS are both 192.168.0.0/24 and 10.1.10.0/24. The first two are for the WAN interface so it can communicate with the Comcast router (10.1.10.1). The next two are for the TP-Link router to communicate with the Workstations. The goal of the LOCAL_BLOCK_IN/OUT is to prevent other computers on the local network from communicating with each other. Then there are the HTTP, HTTPS, and DNS allow blocks. The service types are allowing ports 1024-65535 on the opposite side and 80,443,& UDP 53. BLOCK_REMAINING_IN/OUT does just that, blocks the remaining protocols, addresses, and ports.
