[MLandi]

I've never wanted to block incoming connections from an IP or range, but I am seeing unwanted incoming connections and want to add firewall rules to block them. I did a lot of reading and IPTABLES is still confusing to me. Simple question, does adding this line to the Firewall Rules block connections from 179.60.147.x? (The "FORWARD" confuses me.)

iptables -I FORWARD -s 179.60.147.0/24 -j DROP

[Per Yngve Berg]

Incoming connections are blocked by the Firewall by default.

The connection must have been started from your LAN or you have opened a port at the router.

The FORWARD chain is for routing between WAN and LAN. For processes running at the router, use the INPUT chain.

[MLandi]

[egc]

Incoming connections are already blocked by default so no need to block it again.

It helps if you describe your problem.

[MLandi]

[Per Yngve Berg]

Looks like you have ssh open on the wan and someone trues to login.

[MLandi]

[Per Yngve Berg]

With password login disabled you are safe.

Blocking it will only move the attack to another address.

[MLandi]

[ho1Aetoo]

Then you obviously didn't use a smart port. (there are ~50,000 ports and scanning them all takes a very long time)

You have the option "limit ssh access" under the firewall settings which can provide additional security.
The option should prevent ddos / brutforce attacks - they can create a very high load on your router.

Otherwise there are some other ways to harden ssh but not with the built in dropbear server.

E.g. disable banner, don't allow root login, use fail2ban etc...
(the dd-wrt banner directly reveals which system is used with which software and which security vulnerabilities are involved
the root user also makes it more insecure, because most ssh attacks target this user, if you use an unknown user the authentication attempts fail just because of the user = double security and not only the key)

fail2ban can be scripted so that it automatically bans according to desired criteria.

To block single IP-addresses manually makes no sense at all, if you look at how big the IPv4 address space is you will never be able to handle it.

[MLandi]

[ho1Aetoo]

this is complicated... because as you have already correctly pointed out dd-wrt has no setting for it

https://lokcon.me/2020/05/03/ddwrt-ssh-banner

https://www.reddit.com/r/DDWRT/comments/bj8t92/disable_root_login_on_dropbear/

[MLandi]

[ho1Aetoo]

Best practice create another user for ssh.
But this is as said complicated at least with the dd-wrt possibilities....

[MLandi]