How to block webinterface of my asus with iptables

[wmzyk]

Hi
My post-firewall file is simple so far

#!/bin/sh
iptables -D INPUT -j DROP
iptables -A INPUT -p udp --dport 21    -j ACCEPT
iptables -A INPUT -p tcp --dport 80    -j ACCEPT
iptables -A INPUT -p tcp --dport 81    -j ACCEPT
iptables -A INPUT -p tcp --dport 12000 -j ACCEPT
iptables -A INPUT -p tcp --dport 6112 -j ACCEPT
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to-destination
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 6112 -j DNAT --to-destinati
iptables -A INPUT -j DROP

could anyone help me add a line which blocks webinterface from wireless clinets and only webinterface

[wpte]

You used the command already once: "DROP"
usually port 80 is the webinterface... not sure what you have

anyway, just put "DROP" instead of "ACCEPT" and you have the code:

iptables -A INPUT -p tcp --dport 80 -j DROP

easy

your iptables look good btw
however, these portforwards:

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to-destination
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 6112 -j DNAT --to-destinati

are usually not needed when the service already runs on the ip-adress needed

[wmzyk]

You missunderstood me

iptables -A INPUT -p tcp --dport 12000 -j ACCEPT

ssh dropbear

iptables -A INPUT -p tcp --dport 81    -j ACCEPT
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.1:81

this should allow access from wan to my webserwer placed on asus apache

iptables -A INPUT -p tcp --dport 6112 -j ACCEPT
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 6112 -j DNAT --to-destination 192.168.1.2:6112

Warcraft part

Now i need to drop connections made from WLAN to webinterface of asus (still on port 80) but ofc i want to allow surfing web on those ones

Putting

iptables -A INPUT -p tcp -i eth2 --doprt 80 -d 192.168.1.1 -j DROP

doesnt change anything

[wmzyk]

Really no one can help me ?

[wpte]

Really no one can help me ?

Basicly what you want is that people on the wireless lan can't connect to the webinterface?
I'm still a bit unsure if that's possible, I need to overthink this