Port forwarding and ACL

Router
1

Is it possible to specify source IP address for improving security on port forwarding ?
I triied using an ACL but it doesn’t work…

Any idea ?

From Lucy ?

2

Yes. Restrict the source in the port-forward rule itself rather than creating a separate ACL rule:

  1. Open System → Advanced Settings to enter LuCI.
  2. Go to Network → Firewall → Port Forwards and edit the forwarding rule.
  3. Under Advanced Settings, set Source IP address to the permitted public IPv4 address or CIDR subnet, for example 203.0.113.10/32.
  4. Save and apply, then test from both an allowed and a different external connection.

This works only if the remote side has a known public source address; if it changes dynamically, the rule will stop matching. Also ensure the address entered is the Internet-visible source IP, not the remote device’s private LAN address.

This reply was generated by AI. Please verify its accuracy.

GL.iNet Technical Support reviews and responds to relevant threads on business days. Please allow time for a staff response.

3

Hi,

For ACL you need to specify protocol tcp+udp or something different than 'any'.

For port forwarding there is a distinction which counts for importance.

First off ACL only allows traffic between zones, these ACL rules also reflect on the traffic rules tab in luci (advanced settings) in the firewall settings.

In luci there is also 'device' as destination this does not exist in the gl ui, but this means any traffic from src x to dest 'device' (router), so traffic can be allowed into the router, or blocked defined by the course of action you define, one example is allowing a server on the router itself, or a wireguard server where nat translation is not necessarily (NAT = network address translation)

Port forwarding does translation, meaning if you define a port it translates the port either to a different port or a different ip or both.

Usually when portforwarding a port from wan this is a perfect example, because upstream is not aware of the downstream network (lan), so here is why NAT translation happens, it redirects to the correct ip and port, and as a side effect allows the traffic.

Edit:

Depending if you still need to portforward, and still need a source address, then you must use luci and click on firewall -> port forwards create a rule, and in the advanced tab there is also source ip, though it is risky to limit it because a isp ip change is out of your control, you may want to look to something to block countries a plugin like luci-app-banip could help on this, there are some guides on the internet for this.

4

I could configure using luci.
Thanks
But it’s one rule per IP ?

And I disable my port forwarding on classic web interface.
I could not make it work with ACL ? Did I miss something ?

5

For unrelated public IP addresses, use one LuCI port-forward rule per source IP. If the allowed addresses form one network, a single CIDR can cover them—for example, 203.0.113.0/24. Avoid broadening the CIDR merely to reduce the number of rules.

The ACL did not work because a port-forward rule is DNAT and also permits the matching forwarded traffic; an additional ACL ACCEPT rule does not narrow that existing port forward. Put the source restriction directly in each LuCI port-forward rule, and keep the unrestricted rule in the GL.iNet interface disabled or removed. Ensure each rule uses the required protocol rather than Any.

This reply was generated by AI. Please verify its accuracy.

GL.iNet Technical Support reviews and responds to relevant threads on business days. Please allow time for a staff response.

6

That is only a problem with gl ui I think, in luci you can add multiple addresses, and also have more port combinations you can combine into one rule.

Please note that for luci, especially older versions of luci don't work well with mobile view when adding multiple addresses in a rule for android, i always had to use pc so that the enter key works, or if you are technical enough you can use ssh.

As for the rest, it is not exactly clear to me what your attempt may be.

Is it about getting a device accessible over a vlan through a different vlan?

Or is it to open a port for remoting?