Securing the intranet

[unaiur]

I've just realized that my Asus router isn't protecting my intranet. I've connected my laptop, the wl500g & the cable modem with a hub, so my laptop doesn't belong to the intranet. In the laptop I run:

route add -host <wl500g external ip> dev eth0
route add -net 10.2.1.0 netmask 255.255.255.0 gw <wl500g external ip>
And I keep connecting to my PC behind the wl500g router. I've reviewed the iptables FORWARD'ing rules:

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT all -- br0 br0 0.0.0.0/0 0.0.0.0/0
2 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
3 43 11685 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
4 2 145 ACCEPT tcp -- vlan1 * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x16/0x02 limit: avg 1/sec burst 5
5 0 0 ACCEPT tcp -- vlan1 * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x04 limit: avg 1/sec burst 5
6 0 0 ACCEPT icmp -- vlan1 * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 icmp type 8
7 0 0 ACCEPT tcp -- * * 0.0.0.0/0 10.2.1.21 tcp dpts:25600:25699
8 0 0 ACCEPT udp -- * * 0.0.0.0/0 10.2.1.21 udp dpts:25600:25699
9 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:6112
10 0 0 DROP all -- vlan1 br0 0.0.0.0/0 0.0.0.0/0
I discover that the rule 4 is forwarding the connections to my intranet. Why is that rule there? How can I remove it from the web admnistration? What are I doing wrong?

I've already enabled WAN to LAN filtering, defaulted to DROP.