[ddacct3]

On Kong 36070, in order to restrict admin access from another subnet, I tried these 2 variations:

iptables -A INPUT -p tcp --dport 80 -s 192.168.1.100 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
(Here, I only wanted 192.168.1.100 to get admin access)

and also this:

iptables -A INPUT -p tcp --dport 80 -s 192.168.1.101 -j DROP
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
(Here, I wanted everybody except 192.168.1.101 to get admin access)

When the DD-WRT router had WAN access disconnected, this seemed to work as I thought it would, but as soon as the DD-WRT's WAN access was reestablished and had Internet access, the device that should not have been able to access the admin page was able to do so.

Any idea why?

[Alozaros]

yep those stop working for some odd reason also you
cant even change microserver port (GUI) to something else
its beeng like that the last 7-8 builds or more
the other reason is if you are using a modem or pppoe
as modem uses port 80 to communicate with router...

try to address br0 instead if they work at all
iptables -I INPUT -i br0 -p tcp --dport 8083 -j DROP
iptables -I INPUT -i br0 -p tcp -s 192.168.1.101 --dport 8083 -j ACCEPT

you can try with MAC address instead but those are not working on my other routers with BS builds too

iptables -I INPUT -i br0 -p tcp --dport 80 -j REJECT
iptables -I INPUT -i br0 -p tcp --dport 80 -m mac --mac-source xx:xx:xx:xx:xx:xx -j ACCEPT

[ddacct3]

I was able to get it working.

1. Turns out -I was needed instead of -A. I think since the commands were being appended to the end, some other default rules were triggered before it ever got to my rules.

2. In -I, since they are being inserted, I needed to reverse the order so that the rule being inserted last was the one being processed first

Thanks for the tip. I was looking at your version of the rules and wondered what the difference between -I and -A was, and that happened to be the answer to my problem.

However, I do need to point out that the following code is a security risk:

iptables -I INPUT -p tcp --dport 80 -s 192.168.1.101 -j DROP
iptables -I INPUT -p tcp --dport 80 -j ACCEPT

The second line exposes that port to the WAN and anybody could access it, which may not be what you are looking for if you just want anybody from the LAN to access it.

So it should be something like:
iptables -I INPUT -p tcp --dport 80 -s 192.168.1.0/24 -d 192.168.1.1 -j ACCEPT

[Alozaros]

in DDWRT INPUT chain is the local LAN
FORWARD is the WAN

also this is not my suggestion too
iptables -I INPUT -p tcp --dport 80 -s 192.168.1.101 -j DROP
iptables -I INPUT -p tcp --dport 80 -j ACCEPT

look at my post above !!!!

this is security risk
iptables -I FORWARD -p tcp --dport 80 -j ACCEPT