EdgeOS WAN IN Firewall Rules

Video 1 of 3 in the configuring firewall rules series is here!
We look at the WAN_IN type of rules and how to use them for blocking the source but allowing the destination for DNAT completion!
You can allow or block services and ports based on IP or subnet. You can also setup a time based rule to allow or block service a specified time!
The next video will cover outbound rules and the third video will cover local rules!
Subscribe, comment, share, and give a thumbs-up!

[@JoesCoralReef]

Your videos are great. Im by no means a network expert and my new EdgeRouter was a little beyond my knowledge. I was just trying to forward some ports, argh. After watching a few of your videos, I learned allot and was able to get setup. Thank You.

[@chrisgardner4144]

Willie, just what I needed today. Thank you

[@mino070382]

Thank you, for making this video! Defining source and destination helped a lot.

[@bjornmuller613]

Absolutely awsome. Thank you very much for your efforts.

[@AP-514]

So much for you answering Questions..You have not really answered but 1 or 2.....

[@JukesDE]

Helped me understand why my minecraft server wasnt reachable. Thanks

[@seanwoods1526]

I live this back to basics video series.

[@marcelbollhalder7289]

Absolutely awsome. Thank you.

[@PabloAGerbasiS]

Thanks a lot! excellent! I'm looking forward for more videos like this one on the EdgeMax OS.

[@aricmoody1484]

Dude I love your videos. Absolutely great!!

[@santospoland]

Excellent video!

[@timaldridge4236]

Great video - perfectly demonstrated

[@MatthewDowell]

Great video, I do feel a little better about blocking. It would be nice if you did a few more WAN IN "allow" rules for instance dedicated connection to inbound VoIP requests.

[@zippytek]

Your videos have been a huge help in getting our network setup how we want it. Do you think you could do a segment explaining how to handle port forwarding/DNAT/FW rules to handle dual ISP / dual WANs?

[@DEMinSoCAL]

I wish your videos spent more time on what the different choices mean and WHY you choose them. For instance -- drop vs reject. What is the difference? Established vs New vs Related. What do those mean? I see you choose them, but I don't know why. Source port vs destination port -- why do you put port 80 in the source tab but not the destination tab? Do all "block" rules put the port in Source and all "allow" rules put port in Destination? More details on these type of topics will help us understand the core of how this works and with this understanding we can know how to create our own rules instead of just copying step-by-step what you do with no idea why.

[@lkentwell249]

Might be a stupid question but if you want to prevent people on the inside from accessing the internet why block the inbound responses rather than simply blocking the outbound traffic?

[@shannonbreaux8442]

I see you can specify a Mac address as well so if I want to block a IP camera from accessing the Internet from outside my network I can just created a rule for that ? If so how do I do that ?

[@MrDjegsi]

Hi , nice video , l just need to block specific IP ? how can this be done ?

[@misterB654]

thanks .. just what i was looking for.

[@b.w.oostdam8875]

Hello Willie. Thank you for your very informative video's. I would like to aks 2 questions. 1. Does realy in depth documentation exist on Edge OS. 2. More importantly: I use the latest firmware (2022-03-01). Are WAN_IN firewall rules automatically assigned to ETH0 ? The interface is not clear about that and does not present ETH0 in any selction list. Thank you for you trouble.

[@ivanstefko]

Hi Willie, really nice tutorial. Thanks! I have one additional question. I need to do exactly the same what you did - bock internet access (port 80 and 443) for ALL pages but need to allow access only to 1 page - e.g. google.com (or my personal page / runs on 443). Is it possible to do it? Thanks!

[@anonvpn7542]

If you want to stop internet access for a specific IP or IP's rather than blocking the incoming reply wouldn't it be better to block the outgoing request? Either way would work just trying to understand if there is a reason you doing it by blocking incoming replies.

[@techdigitalgroup]

Question: Can I block mac address for some iPhones on a particular LAN using firewall?

I Love you , I love your brain, thanks is very util your videos.

I owe you a beer. 🍻

[@jungleboyfromoz]

Hi Willie, How can I lock down all source ports, and then assign individual rules for ports I want open ? Do you have a video on this ?

[@williamhalsey1931]

Willie, have watched many of your videos! Great help. Using a synology to do surveillance, can you you do a video about setting up Synology on lan1 and putting cameras on lan2?

[@OscarVasquez1]

Great Video! Thanks!

[@wrightpc1215]

Great video thanks

[@Raedenwins__]

Great video, I'm struggling with getting an edge router to block ip ranges on eth0 which connected to a comcast modem.. and only allowing access to the modems gateway.. I'd like to block guest wifi on eth3 to anything not the big capital I internet past the comcast modem

[@PrestonMainard]

The EdgeMax seems like a great product line but I'm not a huge fan of the interface. I use pfSense and it has a sleeker interface and it's easier to make firewall rules. Nice video though!

[@leo.valentyme.604]

Hello Willie, Why did you pick the source port = 80 why not the destination port is 80 since the source port is randomly generated? is it because WAN to internal?

[@caseyjwatson]

I was confused by this as well. It’s because he’s editing the WAN_IN ruleset which only applies to incoming packets. So with these rules the web request is still sent, but the incoming server response is dropped. Watch the next video for an example of WAN_OUT filtering.

[@MicheIIePucca]

I was confused as well. The default state of the firewall should be to allow outbound traffic from inside, and to deny inbound from outside (wan/internet). If his test inbound (from outside) to the webserver (inside) on port 80 shouldn't have worked without specific inbound rules.

[@clydebryant2665]

A great video. I'm new to Edgerouter. I just purchased and EdgeRouter X. I would like to block GEO IPs in particular Russian and Chinese IPs. Could you do a video showing how to configure the EdgeOS to block GEO IPs?

[@mikewood9869]

Hi Willie man I find myself watching your videos all the time. However I've been searching without much success about that 'group null' destination in the WAN_IN ruleset. What is that group null exactly. Is that somehow more efficient than selecting all protocols? Don't think a ruleset can be created in the gui that way without copying from WAN_IN. Many many thanks to you your vids have saved (or enhanced) my butt a few times!

[@debido2023]

I've noticed in your videos, you have WAN_IN set to eth0/in. So, starting from factory reset. WAN_IN isn't set for an interface when you use the wizard, it's blank. Should it be? Do I have to manually set it to eth0/in? I've had it off for months. Firmware 1.10.10

[@Martin-ot7xj]

If we make a rule secure blank and destination our all ip address, if we set like that, that means anyone from outside or internet can't access to our network? That is correct??

[@Anmmar99]

Thank you for the video. Can you block a specific website like KZbin by creating a rule?

[@PhilipIngram]

Curious about upnp setup, is that command line or config tree only? If so, how would one apply it to switch0? Seems like it wants a physical interface only.

[@rhodges26]

I am confused and or doing something wrong i am trying to block all traffic to port 22 only allowing certain IP address i have edit a rule set in wan but it will not block port 22 traffic.

[@LarcMusic]

I need rules for Mac Address. No Found

[@jbplanhouse9028]

how to make two networks not talk to each other, only with EdgeRouter, Thank You

[@linuxpc4me555]

Just watched this video and I really appreciate the info. My question to you is........ Would you suggest on a edgerouter, I use these rules to block all traffic in except 80, 443 for basic web user inside the lan? It seems that would be a good thing to prevent stuff sneaking in other ways, or am I being to paranoid?

[@linuxpc4me555]

Thanks so much for your reply. I am also experimenting with pfsense. I have an edgerouter lite and two edgerouter X that work really great but I have not experimented much with the rules. I am going to now that I have watched your great videos. Thanks again!

[@scubieman]

How do you block all ports but port 80? I am having issues

[@gusevening4910]

Another great video! What if you wanted to block a group of external addresses from port scanning or trying to access your network. Would you just add an address-group and add it on the destination tab?

[@gusevening4910]

***** Thanks, I guess it would be DNAT. Opening up port 5060 for SIP and I want to block certain addresses to that port / host.

[@gusevening4910]

***** So I created a group firewall/nat group of blacklisted external addresses. can I add the group to a drop rule on the WAN_IN ? I'll play around with it to see if that works. Thanks for your videos!

[@gusevening4910]

***** ok, sounds good. Thanks!

[@gusevening4910]

I added DNAT rule to point to address for SIP. No matter what I try I can't block certain addresses with the firewall rule. I have a rule to BLOCK_SIP to drop as the number 1 rule in order. Source is the address in the BLOCK _SIP group with the addresses I want to block, specified port 5060. I even specified the Destination with the address of the SIP server and port 5060. everything goes right through unless I disable the DNAT rule. Does the router need to be rebooted for the rules to take effect ?

[@gusevening4910]

can I email you a screenshot at the address on your website ?

[@jaydplus1046]

Nice, i wish i could train for this

[@jonaseriksson3782]

For three hours I'd been trying to open ports unsuccessfully. Turns out my wan_in wasn't eth0, it was eth1. Fuck me.

[@icr12345]

Great Video Brou. some video bandwidth limit for user o group later.

[@docd4u]

You mentioned DNAT, so what is its purpose?

[@docd4u]

Thanks, for some reason I have never heard of DNAT & SNAT. Thanks for your videos, after watching I was able to setup blocking for DNS. Comcast cut me off saying I was taking part in a large scale DDOS attack. I told them I had a firewall and my port 53 was showing closed. Now after watching I set it up for only my OpenDNS provider and no other!

[@chetansoni139]

Hi, how can i remotely manage my EdgeMax to be very specific: i need to access it from my Office PC only.

[@michaelcooper5490]

Chetan, You can do it with the IP of your office PC in your firewall rule and tell it to only accept connections from that IP. You could also setup a VPN from your office PC in to your network via the EdgeRouter. There are a ton of videos on how to do that. If you need help I can help you but I do not want to step on any toes so ask Willie first .....

[@StaxxxInMyJeans]

I have dual WAN configuration. Second WAN only works when first one failed over and it is transfer limited by my ISP. Is it possible to block all video sites like youtube, vimeo, etc. only on my second WAN? If it is possible, what is the easiest method to do that?

[@StaxxxInMyJeans]

Thanks for an idea! :-)

[@joevining2603]

This is great and I love the idea of being able to schedule rules, but I tried this and am having trouble with the time-based settings. I can get the rule to block port 80 and to block only a specific IP or all IPs and it will even work if I put in a day of the week setting, i.e. Thu for Thursday. But, if I try to put in a date and time range it doesn't work at all. I'm on 1.8.5 and even rebooted and deleted and re-created the rule. The rule works except when I try to use a date and time range - no errors, but it doesn't drop traffic. Any ideas?

[@joevining2603]

The box I'm using for playing along is my own. I have other units in production in the field, but I got this one to use in my own office so I can mess with it for testing purposes. I can try downgrading and find out what happens tomorrow. I'll let you know - maybe it's a bug as the GUI seems pretty straight-forward.

[@joevining2603]

Okay, tried it on both 1.8.0 and 1.7.0 and the date/time based rule it doesn't work on either of them, either, so we must be doing something wrong or it's a long-lasting and undiscovered bug.

[@joevining2603]

I've tried assigning destination interfaces, but that made no difference. Also, I tried removing regional time settings, going back to UTC time and applying the rules to UTC to no avail. It's too bad because this would be a really useful function.

[@elvispressedtalot9899]

Lmao .. i managed to get the block working .. But Ubiquiti's version of block social-network sites... Gives me .. the results of everything blocked... from youtube/hotmail/gmail/facebook/twiiter/snapchat/instagram/ world wide web basically...lol what am i doing wrong??

[@paulgalbraith4149]

This never went into allowing actual inbound traffic initiated from the outside.

[@skjalglandsem7440]

I have a feeling I agree with you. The "allow web server" rule would have to be placed first, right? The first rule will drop any packet destined for port 80, so rule #3 never comes into play... Unfortunately I do not have an EdgeOS to test the hypothesis with.

[@LE100u]

how about pppoe interfaces on top of eth0 ? do we apply wan_in to eth0 or pppoe? I struggle to setup vpn port forwarding. I think firewall is blocking incoming vpn connections

[@mbottambotta]

I'm facing the same issue. did you manage to solve it? if so, how? thanks!

[@LE100u]

@@mbottambotta Hi, basically masquerade for NAT needs to passthrough VPN traffic so: In Firewall/NAT, go to NAT tab, click "add destination NAT rule", Add description, click enable, Inbound interface is Your pppoe0(its pppoe0 in my case). Translations/Address is Your internal VPN server IPv4, What VPN are You going to use? pptp, L2TP? I use all. For PPTP port 1723, IP-Sec port 500, IP-Sec-TUN port 4500,. To forward Gre and L2TP instead of TCP click "choose a protocol by name" and pick GRE and L2TP from dropdown.

[@mbottambotta]

@@LE100u thanks! I'll try this out

[@testthisfordecficiencies]

The processor is getting taxed. Consider enabling Hardware Offloading.

[@produKtNZ]

This is that 10 minute or so fucking video that would have saved hours of stress as I failed to learn firewalling at a more basic-ass level . . . ffs

[@WillieHowe]

Can't tell if this is a good or negative comment...

[@produKtNZ]

*I found your video - positive! *I revel in having found it - positive! *Finding it earlier would have saved me a lot of frustration - Positive revelation! *Anger as i reflect on my failings - negative!

[@WillieHowe]

@@produKtNZ Don't be too tough on yourself, we all have these moments.

[@produKtNZ]

@@WillieHowe yeah that's true . But I've been in IT coming up 12 years soon , hence me being grumpy about missing some of the basics :) Also ! Great to have you reply to a video you posted some 6 years ago ! So many don't !

[@BrianG61UK]

This doesn't make sense. How can blocking port 80 INCOMING stop you viewing websites?????? That's what you'd do to stop people outside viewing websites on YOUR SERVER?????? I'M BAFFLED??????

[@brettzink]

Because port 80 is the source port. So he's only blocking the return traffic. It's a really weird/backwards way of looking at it.