Blocking inbound traffic by IP address

Question

&nbsp;Just got an Orbi and am astonished that it is not possible to block inbound traffic by IP address, either explicitly (as a range), or from IP blacklists available from spam blocking lists. Being able to block incoming traffic by geographic region can be incredibly helpful, as many attacks originate in Russia in China. The fact that Orbi has DoS detection and gives me log entries like this "DoS Attack: SYN/ACK Scan" and no way to stop it is amazing.&nbsp;This topic has been raised in the past and it always gets&nbsp;closed with the statement that this is "beyond the scope" of a consumer level router and that only $1,000+ enterprise routers can do it. Bull.&nbsp;A $35 Linksys WRT54G running the open source DD-WRT firmware can do iptables blocks of IP addresses and ranges. A $250 Orbi should be able to do this without breaking a sweat.

schumaku · Answer

Same feature does not exist on the Nighthawk routers, too.

Why does a consumer device have the Block Services - what does essentially the very same for _outgoing_ connections based on the source IP on the LAN - but not what we're asking here for blocking source IP addresses from the WAN?

Fully agree with you, including the B***.

tsig · Answer

so put that $35 router in front of your Orbi and run it in AP mode.&nbsp; Easy enough.&nbsp;

schumaku · Answer

Vote there -&gt;&nbsp;https://community.netgear.com/t5/Idea-Exchange-For-Home/Firewall-Rules-for-Internet-WAN-gt-LAN-on-IPv4-and-IPv6-LAN-gt/idi-p/1547972

Forum Discussion

Blocking inbound traffic by IP address

3 Replies