Asus router has ftp server open to wan, how to stop this?

[FreshJR]

I have an Asus RT-AC68U router, but I assume most of the recent models carry the same interface. Here is my issue.

I started both the windows samba and ftp features for an attached USB to this router. The issue is that the ftp server the router started is being made public to wan side and I could not find a feature to disable it.

As a temporary measure I port forwarded 192.168.1.1:20 & 21 to forward to ip 127.0.0.1:20 & 21 for tcp traffic. That seemed to work but I don't know if there is a better solution. Or if this is an appropriate solution to hide the ftp server.

Is there a tool to check if I have any other open ports to the wan side? I would like to close my entire lan network off from the outside.

If I need to get into the lan side of my network, I do have a vpn server running on this router that I perfer to use.

Question 2: I also have a 4TB WD MyCloud that I tried to close off from the outside entirely. I went to firewall -> network services filter and blacklisted all requests from the source lan ip 192.168.1.100, putting a wildcard of *.*.*.* in the destination ip, trying to give the mycloud zero outside access. I disable this rule every couple months just to keep the firmware updated.

Are my security measures correct? They seem to work, but I am a rookie when it comes to networking.

 

[ImDonly1]

1. Usb applications then servers center then ftp tab. Turn off ftp wan access, maybe even turn off anonymous access.

2. For the mycloud, I think if you disable the cloud ability, it won't respond to wan requests.

 

[Elixer]

Checking ports:
https://www.grc.com/x/ne.dll?bh0bkyd2 (shields up)
http://www.checkmyrouter.org
http://upnp-check.rapid7.com/

As for FTP server, yes, it is meant to be accessed from the WAN, and I don't recall if there is a way to turn that off with the official firmware or not.
I would use iptables to fix this, something like
iptables -I INPUT -i eth0 -p tcp --dport 21 -j DROP (if it is eth0)
iptables -I INPUT -i xxx -p tcp --dport 21 -j DROP (where xxx is the interface of the WAN)

That just means for input, on the WAN device (eth0 or whatever), and it is tcp port 21, then drop the connection.

You can use iptables for your other question as well, except you want output instead of input, and of course, the right ports and all that.

 

[FreshJR]

1. Usb applications then servers center then ftp tab. Turn off ftp wan access, maybe even turn off anonymous access.

2. For the mycloud, I think if you disable the cloud ability, it won't respond to wan requests.

Do you have the same router? What fw? Seems I am missing that option. Bellow are my options:

Enable FTP
Allow anonymous login
Maximum number of concurrent connections
Character set on FTP Server

I did disable mycloud cloud access in its GUI and do believe it works, but just tried to double protect myself if the samba shares somehow get forwarded outside my lan and onto the wan thru some uPnP glitch. Maybe paranoid but better safe then sorry, 4Tb is a lot of personal documents.

I don't believe this router has iptables support but ill try to look it up. I'm not really looking to switch to ddwrt, openwrt, tomato, etc to get that support. This router is rock stable and performance is insane.

 

[ImDonly1]

Do you have the same router? What fw? Seems I am missing that option. Bellow are my options:

Enable FTP
Allow anonymous login
Maximum number of concurrent connections
Character set on FTP Server

I did disable mycloud cloud access in its GUI and do believe it works, but just tried to double protect myself if the samba shares somehow get forwarded outside my lan and onto the wan thru some uPnP glitch. Maybe paranoid but better safe then sorry, 4Tb is a lot of personal documents.

I don't believe this router has iptables support but ill try to look it up. I'm not really looking to switch to ddwrt, openwrt, tomato, etc to get that support. This router is rock stable and performance is insane.

I have the ac56u and am using the merlin fork (stock with some modifications/updates)
http://www.snbforums.com/threads/fork-update-for-374-43-available-v13e1.18914/

My ftp page looks like this...

You can use the regular merlin firmware (stock with modifications) too
http://www.snbforums.com/threads/asuswrt-merlin-378-55-is-now-available.25874/
The merlin fork is based on older asus firmware before they locked down wifi transmit power. He just updates all of the packages and fixes to the latest, while also adding merlin's tweaks.
The regular merlin firmware is based on the latest asus firmware (after they locked down transmit power) with his own updates, fixes, and tweaks.