How to open LAN port to just one external WAN ip address?

Question

How do I configure my home LAN router (D-Link Dir-882) to accept communication to a LAN IP&port just from one specific WAN IP address only?

More detailed;

I have a port open on my DIR-882 Home LAN router because i routinely access it from a WAN computer using VNC software. However, my home LAN open port gets attacked by people trying to gain access. i have tried changing ports, and changing IP addresses but the attackers keep finding my IP and open port. So, i would like to tell my home LAN DIR-882 Router to only open the specified port for traffic only to&from the WAN IP of the computer i am using. So, from the routers web GUI i selected "Turn ipv4 filtering ON and ALLOW rules listed", and entered the following rule;

Name: VNC
Source IP address range: WAN: (i typed in the WAN ip address of the computer i use to access my home computer)
Destination IP address range: LAN: (i typed in the LAN ip of my home computer)
Protocol and port range: ANY: (i typed in the port i want open on my home LAN computer)
Schedule: always enable

.... but then i couldn't browse the internet on the LAN computer.

Any guidance would be appreciated,
thank you.

ps: the LAN & WAN computers are all iMacs.

Answer 1

After many hours of googling, I found a solution posted years ago from a guy who had the same problem. http://forums.dlink.com/index.php?topic=61517.15

In the home LAN Router d-link DIR-882 web GUI i turned on "Turn ipv4 filtering ON and ALLOW rules listed" and created the two following rules.


Rule 1

Name: allow LAN traffic
Source ip: LAN : 192.168.0.1 - 192.168.0.254
Destination ip: WAN: 1.1.1.1 - 254.254.254.254
Protocol & Port: ANY
Schedule: Always Enable

The above rule lets all LAN computers initiate communication to the WAN. The LAN router automatically allows in any reply from the WAN so there was no need to set any rules to allow incoming WAN communication to the LAN (see NOTE at bottom).



Rule 2

Name: give one WAN-IP access
Source ip: WAN: my WAN IP
Destination ip: LAN: the LAN IP
Protocol & Port: ANY
Schedule: Always Enable

The above rule lets my WAN IP address, and only my WAN IP address, initiate communication to the LAN IP through -ANY- LAN port. Alternatively, there is a way to specify just one port instead of -ANY- but doing so would mean writing another rule and altering the above rule.



Lastly, using the Web GUI for the router i forwarded the LAN port i want the WAN IP to access. If you don't forward the LAN port, then the port will remain closed to the WAN even if, in the above rule, you allow the WAN to access the any port (or that specific port).



Thank you.

NOTE

http://forums.dlink.com/index.php?topic=48059.msg199390#msg199390
...if you activate "Turn IPv6 Firewall ON and ALLOW rules listed" all inbound and outbound traffic is completely blocked. In this situation you have to define at least one rule that allows outgoing traffic of any kind (which implicitly allows inbound response traffic due to the firewall's stateful inspection feature).

Special Shout out to SuperUsers M Virts and Tom Yan for recognizing my problem was legitimate and pseudocoding possible solutions!

Answer 2

Sounds like you need to add an ALLOW rule to permit LAN traffic out on the WAN port.

In the following I'm assuming the router will recognize 0.0.0.0/0 as the range of all IPv4 address. You can probably use 0-255.0-255.0-255.0-255 instead if it doesn't work. The DIR-882 manual doesn't specify the format.

The Lan-to-internet rule would look like

Source IP address range: LAN 0.0.0.0/0
Destination IP address range: WAN 0.0.0.0/0
Protocol and port range: ANY: 0-65535

You may also want to allow LAN clients to communicate

Source IP address range: LAN 0.0.0.0/0
Destination IP address range: LAN 0.0.0.0/0
Protocol and port range: ANY: 0-65535

If your router has a WAN ipv6 address you may want to enable similar rules for that as well.

You may also be able to switch to DENY rules instead, specifying any wan IP as the source and your LAN machine as the destination. This would prevent the firewall from blocking everything by default. The only concern with this would be splitting this rule into two ranges in order to allow your WAN host access.

Answer 3

It would seem to me that your router handles this in a silly way, that all traffics (i.e., including replying traffics) except those explicitly allowed by a rule. (I'm not sure if all in this case would be only WAN-to-LAN traffics or even including the LAN-to-WAN ones. I suppose you'll have to test to find out.) In other words, it filters on a purely stateless manner.

If that's the case, to make it work you may need to have to have these allow rules:

Source: 0.0.0.0/0, Destination: LAN subnet, Protocol: ANY, Port: 0-(VNC port - 1)

Source: 0.0.0.0/0, Destination: LAN subnet, Protocol: ANY, Port: (VNC port + 1)-65535

Source: remote WAN IP to allow, Destination: VNC computer LAN IP, Protocol: ANY, Port: VNC port

Note that traffics from WAN to other LAN computers that uses the port number of VNC port will also/still be blocked (and they might not necessarily be VNC traffics). So you may need even more rules.

(In fact VNC might only use the TCP port, but meh, too many rules already.)

A perhaps "smarter" approach is to allow the ephemeral ports for 0.0.0.0/0 WAN to your LAN subnet, if the VNC port number isn't within the range. Note that different OSes might use different ranges.

As someone else suggested, you might want to try the DENY / blacklisting approach instead, which might be more tricky though depending on how exactly your can enter the source IP range (like literally A-B or by entering a subnet address with prefix length).

---

I would really suggest to firewall on the LAN computers themselves instead.