RV042G Which rules have priority firewall or forward rules?

[Ryan Hendriks]

I have made a firewall rule that accepts FTP from WAN2 outside to the inside private LAN with IP address specified.

But this didn't work.

When I added in the forward rules that FTP had to be forwarded to this IP address it worked.

I have done some testing but it seems that the firewall rules do not have any priority on the forward rule.

If I disable the forward rule i cannot connect with ftp even with a firewall rule made.

[Te-Kai Liu]

Firewall access rules are designed to work on top of port forwarding rules. Firewall rules alone cannot open up a ftp service to the internet. 

[Ryan Hendriks]

OK, but when I assign a specific external IP address to allow FTP from WAN2 to internal IP address, I still can make a FTP connection from whatever external IP address :

[Te-Kai Liu]

You need to add a Deny All rule, followed by an Allow rule. Here is an example that shows how to restrict SSH to a specific external IP address.

https://supportforums.cisco.com/message/3100507#3100507

[Ryan Hendriks]

So actually you should program it like Iptables? first allow rules and at the end a deny rule? If I would first make a deny rule and then an allow rule will this work or not like in Iptables?

[Te-Kai Liu · Accepted solution]

For RV0xx, an access rule entered last will show on top and gets higher priority.

[Ryan Hendriks]

OK, clear but take at the picture below, I try to make contact with FTP from an external address and it has an allow in the firewall rules but still can't make contact, if you see the log file you can maybe tell me what is wrong?

[Ryan Hendriks]

After some testing this did the trick :

You have to match the source and destination in the deny rule with the source and destination in the allow rules.

Now it works and when I disable one of the allow rules I cannot connect with the FTP server.

So I think this is OK now.