Firewall rules

[arden]

Hi,

I'm trying to setup my ds2411+ with the following network limitations.

Allow connections from the wan to only the openVPN

Allow connections from anything on the lan (192.168.1.1/255.255.255.0)

If not on my lan I'd like to force everyone to connect to the vpn and then aaccess the unit that way.

I've tried a few things but none have worked, any pointers would be great.

Thanks!

[iket]

Plug your DS into your private LAN and any IP on your LAN has full access.

Open the VPN port (1194-OpenVPN 1723-PPTP better check these in the docs) on your FW/router and forward to your DS private IP and connect with your favorite VPN client on the WAN side via your public IP, DDNS domain, etc.

Everything else should be closed on the WAN side assuming you haven't forwarded any other ports. Not sure what you mean by forcing a VPN connection other than not allowing any other than VPN access.

You don't need any firewall rules in your DS.

Is this what you want?

Edit: I assume you have installed and are running the VPN server on your DS and have configured it properly with valid users, etc.

[arden]

Hey,

Thanks for the reply! Yup, vpn is up and running on the DS, but my setup requires that the DS be in the DMZ for other reasons that I can't go into, so all internet connections will be comming into it and why I'd like to limit connections on the WAN side of things to just VPN access for better security.

I've tried adding subnet limits but find that I'm still able to get to the login page on the DSM via the wan and log in which makes no sence considering all connections are ment to be on deny by default if no rule is found?

I currently only have the vpn rule added to allow connections on that port from any, but as it's in the DMZ I can still access the DSM via wan

Thanks!

[arden]

Hey again,

It seems it's working correctly now after a reboot of the unit. I have all the things blocked I wanted blocked and have the vpn up and running.

[daveharrison]

I am trying to do something very similar but I cannot seem to connect to my DS at all. Instead when using DDNS static Ip I only get as far as the router dashboard. It appears no port forwarding is happening although it is all set up to forward. Can you offer any advice. BTW I have not put my DS in the DMZ yet! this would be last resort

VPN server is running both openVPN and PPTP, although I cannot access them

Used the wizard so assume all port forwarding is correct

PnP is activated so should automatically open necessary port

Firewall on router is active but as i say port forwarding should control access

Can you offer an advice. I ask as you seem to have some sucess in getting a VPN from outside your LAN which is all i want to achieve for safe browsing while out and about with my tablet/laptop

Cheers
Dave

[iket]

My suggestion is not to assume anything. Check the router port forwarding rules and make sure. Report back with the info and maybe we can help. You haven't given much to go on.

For VPN PPTP make sure port 1723 is forwarded and/or VPN pass through is enabled on the router.

Personally I think UPnP is very dangerous and a bad idea. I don't want any software having full control of opening ports on my routers. Remember the bad guys will have the same ability. I always turn it off on any router. All real firewalls don't even know about UPnP.

WPS is proving to be the same joke (read about "this great idea" and reaver on google)

Learn how to create port forwarding rules yourself on your router.

And don't forget to have fun.