[broca]

I believe by disabling "allow any remote ip" under remote access will limit who can access the system. What would be the proper "allowed remote ip range"? I tried my local network range but it does no good. Advise and comments please.

[Zyxx]

This setting is only for the WAN Port of your DD-WRT Installation.
It does not prohibit access to LAN.

My advice.
Do not allow any remote IP there to access the router via WAN or SSH or Telnet at all.

Just go ahead enable a Tunnel, e.g. wireguard, and access your router via this tunnel.

[broca]

That is exactly what I want to do - disallow any remote access from the WAN side. I thought disabling "allow any remote ip" will accomplish it. Of course I want to retain the ablility to access the system with ssh from the LAN side. It kind of make sense that I can put in any range different from my LAN ip range. For example 192.168.2.2 to 254 if my LAN is 192.168.1.1/24.

I have no knownledge on Tunneling at all Anything I can read about it?

[Zyxx]

I know the feeling, years ago I stumbled over this too, with my wrt54 router.
A dozen years later I'm still somewhat learning and trying things out

I'd suggest to use the very good guides regarding wireguard, written by @egc here in this very forum.
Just navigate to advanced networking and see the sticky.
(or use this link: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327397)

Have fun