[FlaParrotHead]

Is there a way I can block all INBOUND WAN traffic to one local LAN IP address (all protocols) with the exception of a single TCP port (used for Plex). I do not want to impact local LAN traffic to that device.

The reason is that the device (a NAS server) is seeing, and blocking, a significant about of what appear to be UDP hits and I’d like to shut them down.

[egc]

Transferring this to the right forum.

To get the best out of DDWRT and the forum read the forum guidelines with helpful pointers:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087

If you have not already read the forum guidelines, please do !!

[FlaParrotHead]

I finally was able to catch what I think are the hits on my NAS, could someone suggest what blocks I need to keep these from coming into the interface at all?

Jun 4 23:30:25 ABCDD_WRT kern.warn kernel: [132367.147169] DROP IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:04:4b:b8:a5:cc:08:00 SRC=192.168.1.11 DST=192.168.1.255 LEN=400 TOS=0x00 PREC=0x00 TTL=64 ID=15601 DF PROTO=UDP SPT=34616 DPT=1900 LEN=380

So, a little more information. The device with 192.168.1.11, which is on the subnet of the ISP router in front of my DD-WRT router is an Nvidia Shield streaming box, not on the subnet of the DD-WRT device.

Any clue what the shield may be trying?

[kernel-panic69]

I'm pretty sure sniffing on the 192.168.1.0/24 network with Wireshark will tell you exactly what those packets are, *but* that is UPnP/SSDP broadcast, if I am not mistaken. I do not enable either on anything.

https://www.google.com/search?q=udp+1900+purpose

[FlaParrotHead]

[kernel-panic69]

It's your Nvidia Shield device that is sending out UPnP broadcasts, is what it looks like. I don't know how you don't have access to your ISP router's interface, you should. On DD-WRT, click on NAT/QoS, then UPnP. It is usually disabled by default, so that should not be the issue. I would contact whoever you need to for getting the login credentials on your ISP gear and check it; Are you running Plex on the Nvidia Shield device? If so, it's a matter of turning off local network discovery:

https://www.reddit.com/r/PleX/comments/aaeqaq/disable_upnp/

I really wish M$ and all these IoT devices wouldn't have this crap turned on by default.

[FlaParrotHead]

[kernel-panic69]

Then that explains the entries. Well, hopefully your ISP doesn't allow UPnP through their router.

[tedm]

UPnP is built on multicasting and an ISP cannot forward this on to "the Internet" because all backbone providers filter this out - even if the ISP is stupid enough to actually rebroadcast multicast traffic from end users to their internal network (and still have a functioning network which for an ISP of any size would be impossible) their backbones would ignore it.

I also wish the IoT people would have this crap shut off by default.

However, I wish 1000 times more than that, that people would stop with the chicken-little scare tactics that this traffic "is dangerous" or a security hole. Why are we seeing people freaking out about seeing this traffic on their network in the first place? Oh yeah, it's because they followed some half-azzed guide on the Internet to fire up wireshark and don't know anything about networking.

If your gateway router to the Internet is configured to ignore UPnP traffic, then there is no security hole. Unless of course you deliberately drop malware on to your internal network but if you do that, you have a lot worse problems than UPnP. The security hole aspect is some SOHO routers on the market by default will respond and follow directives from UPnP devices to open port forwards, and the answer is simple - don't use crappy routers to connect to the Internet.

[Alozaros]

tedm than you are free to turn upnp on and enjoy life...even if you get 100000$ router ....its not a cool idea to have it ON...and nope not all ISP are decent and filter traffic, like it should, or the general users neither...and we here all using DDWRT just because its not a crap, like the stock firmware is...and cannot afford 5 number price routers...that could be crap too...as well, people very often have a bad internet hygiene and get some malwares at some point...so upnp is not a clever idea to be used, unless there is a need for it and people understand pros'n cons of it......

Same as ICMP...been blocked or not the eternal debate...

[kernel-panic69]

I'd really like to see proof of this. Do you want to know why? Internet printing. IoT. You name it. Please show me now uPnP and multicast and a lot of other things are *not* forwarded out to the internet, oh wise one.