I believe many will benefit from this as there is not clear answer online and I keep making my policies too strong and locking myself out from accessing the LAN admin panel.

What would be the absolute strongest security settings without locking myself out on the Firewall Zone settings.

The settings go as follows and the options are either accept, reject, or drop. Could someone explain each of the categories so I know what is happening in each and what it is used for? I want to specify that I want to block all inbound connections as I do not have a need for them (close all uneccessary ports and exterior ports that are for inbound connections/remote connections)

This is the panels format:

Zone. Input Output Forward

LAN. Option Option. Option

WAN. Option. Option Option

Guest Option. Option Option

OVPN. Option. Option. Option

1 Answer 1


Some routers understand zones differently, but I hope you will be able to distinguish:

LAN: Accept | Accept | Reject

WAN: Drop| Accept | Reject

Guest: Reject | Accept | Reject

OVPN: depends on what you want.

The reason for WAN inbound DROP rule is to lower the load in case of an unlikely event of DoS

  • is output accept for LAN necessary for functionality. What is the bare minimum I have to set for OVPN for to work and maximum security? What does input, output, and forwarding mean?
    – Luke F
    Commented Mar 5, 2020 at 18:36
  • Inbound LAN to be able to login to admin, outbound LAN to surf internet, outbound WAN to surf the internet, inbound WAN to reject external connection requests. Regarding OVPN it depends on how do you want to use it. If you need to connect to your home network from external source - then inbound ACCEPT, if you need to create VPN connection to something (site-site) then outbound ACCEPT. Forwarding means forwarding traffic destined for specific port to something inside LAN. Without that rule, all connections without servicing ports will be rejected. Commented Mar 5, 2020 at 19:29
  • So if I just need to surf the web then only put the option “accept” for output on OVPN and reject for everything else or drop? Input WAN is drop because that is for remote connections outside the network? Thanks you :)
    – Luke F
    Commented Mar 5, 2020 at 19:39
  • just making sure I tagged
    – Luke F
    Commented Mar 5, 2020 at 19:45
  • Nononono. OVPN stands for Open VPN, it's a feature to securely connect to router or create a VPN tunnel between 2 routers. If you do not understand that, the you better leave everything for OVPN in REJECT or DROP. Commented Mar 5, 2020 at 21:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .