Knowledge Base  >   Firewall  > 

Allow Internet access for certain LAN clients only

This document introduces how to set up Firewall Filter Rules to block most of the LAN clients from the Internet, and allow only some IP to pass. To do this, it requires two Firewall Filter Rules: one to block all the LAN clients from the Internet, and another to pass some IP for Internet access. (TIPS: Also use Bind-IP-to-MAC feature to give DHCP client a static IP)

1. Go Firewall >> Filter Setup >> Set 2 (Default Data Filter), click on an available index number to add new Filter Rules

Add a firewall filter rule on Vigor Router

2. Create a Firewall Rule that blocks all the LAN clients from the Internet:

  1. Enable this Filter Rule.
  2. Set Direction to ”LAN/DMZ/RT/VPN→WAN,” so that this rule filters the outgoing packets.
  3. Leave Source/Destination IP, Source Type, and Fragments as “Any” so that this rule applies to all kinds of outgoing packets.
  4. Set Filter Action to “Block If No Further Match,” it means the router will drop the packets if it doesn't match other Filter Rules.
  5. Click OK to save.
A firewall filter rule that block all the outgoing traffic from any source

3. Create a Firewall Rule that allows the specific IP address to the Internet:

  1. Enable this Filter Rule
  2. Set Direction to ”LAN/DMZ/RT/VPN→WAN”
  3. Click Edit to input Source IP. In the pop-up window, select an Address Type, and enter the IP address that you would like to allow Internet access, which is 192.168.1.10 to 192.168.1.15 in this example.
  4. Leave Destination IP and Service Type as “Any”
  5. Set Filter Action to “Pass Immediately,” so that the traffic source from the defined IP address will be accepted and forwarded to the Internet immediately, no need to check if there are other Filter Rules matched.
  6. Click OK to save.
A firewall rule that allows outgoing traffic from certain source

Now we have two Filter Rules. Most of the packets will be blocked by Filter Rule 2 because they don't match the filtering conditions in Filter Rule3, and Filter Rule 3 will filter out the packets sourced from the specific IP range and pass to the Internet

confirming the filter rules

Go to Configuration > Objects > IP Object, and add an IP Object

  • Give an Object name
  • Select IPv4
  • Address Type IP
  • IP range 192.168.1.10~192.168.1.15
  • Check Invert, which means the object is 192.168.1.0/24 excluding 192.168.1.10~192.168.1.15

Go to Security > Firewall Filters > IP Filters, and add an IP Filter

  • Give a Filter name
  • Enable the filter
  • Direction LAN to WAN
  • Check Specify Interface
  • Select LAN1(192.168.1.0/24) as the Source Interface
  • Choose the IP Object as the source
  • Select all WAN interfaces as the Destination Interface
  • Select Block Action
  • Apply the filter

Now, Vigor only allows the LAN clients 192.168.1.10~192.168.1.15 to access the Internet with the filter above.

Published On: 2024-12-25 

Was this helpful?   

book icon

Related Articles