Ruijie Community

Title: Allow only a specific external IP to connect to device on LAN [Print this page]

Author: Felice Time: 2022-12-17 10:45
Title: Allow only a specific external IP to connect to device on LAN
Hi,
I have a device on a Vlan which I need to reach from remote. To improve security I would like such device to be reachable only from a specific external IP.
I have set 2 rules on ACL/firewall but it doesn't work. I can still reach the device from any external IP.
Rule 1

Rule 2

How can I setup the rules to allow only a specific external IP to connect to the device on my lan at 10.0.3.4 ?
Thanks for helping.

Author: GTAC-Joy Time: 2022-12-19 10:48
Dear sir

You need to map the intranet address 10.0.3.4 to the WAN port address through the DMZ first. The ACL needs to allow the public network address to access the WAN port address and deny other addresses access to the WAN port address

Best regards
Joy

Author: Felice Time: 2022-12-19 12:05
Edited by Felice Massaro at 2022-12-19 12:41

Joy123 replied at 2022-12-19 10:48
Dear sir

You need to map the intranet address 10.0.3.4 to the WAN port address through the DMZ fir ...

Hi, thanks for helping. I am not very familiar with the DMZ.
I have set the above rules and forwarded port 22 on the device I need to reach from remote.
Just to avoid misunderstandings, my aim is to make reachable port 22 on the device at 10.0.3.3 only from only a specific external IP.
As it is now, the port on such device can be reached from any external IP despite the ACL rules above.
I am not sure how DMZ will help to achieve the above.
I would appreciate if you can confirm if the ACL rules are correct and the DMZ is the solution for this problem.
Thank you.

Author: GTAC-Joy Time: 2022-12-19 13:36

Felice Massaro replied at 2022-12-19 12:05
Joy123 replied at 2022-12-19 10:48
Dear sir

Dear sir

After configuration, can all users access intranet devices?

Author: Felice Time: 2022-12-19 14:57

Joy123 replied at 2022-12-19 13:36
Dear sir

After configuration, can all users access intranet devices?

I think there is a misunderstanding on what I would like to achieve.
I have a device (Raspberry Pi on a Vlan). The device IP is 10.0.3.3
I have set port forwarding on port 22. The port can be reached from internet.
I have set two rules in ACL as per my first post to restrict the external IP that can reach 10.0.3.3:22 to a single IP from internet.
The problem is that the rules on ACL do not prevent other IP to reach 10.0.3.3:22
The question is how to restrict external IP that can reach 10.0.3.3:22 from internet.

Author: GTAC-Joy Time: 2022-12-21 22:40

Felice Massaro replied at 2022-12-19 14:57
I think there is a misunderstanding on what I would like to achieve.
I have a device (Raspberry Pi ...

Dear sir

After the intranet address is mapped you need to fill in the mapped port and address in the destination address and port

Welcome to Ruijie Community (https://community.ruijienetworks.com/)