|
317 | 317 | 6. The router has a firewall filter/mangle/nat rule that overrides the settings
|
318 | 318 | at the "/ip service" menu.
|
319 | 319 | Usually, those are rules in the "input" chain.
|
320 |
| - Theoretically, rules in the "prerouting", "dstnat", "output" and/or |
321 |
| - "postrouting" chains can also cause such an effect. |
322 |
| - By default, RouterBOARD devices have a filter rule in the "input" chain that |
323 |
| - drops any incoming connections to the router from its WAN interface, so if |
324 |
| - your web server is not in the LAN, the connection may be dropped because of |
325 |
| - that. |
326 |
| - If that's the case, either disable that rule, or explicitly whitelist the |
327 |
| - API port. You can whitelist the API port on all interfaces by issuing the |
328 |
| - following command from a terminal: |
| 320 | + Theoretically (rarely in practice), rules in the "prerouting", "dstnat", |
| 321 | + "output" and/or "postrouting" chains can also cause such an effect. |
| 322 | + By default, many RouterBOARD devices have a filter rule in the "input" chain |
| 323 | + that drops any incoming connections to the router from its WAN interface, |
| 324 | + so if your web server is not in the LAN, the connection may be dropped |
| 325 | + because of that. |
| 326 | + If that's the case, either disable that rule (not recommended), or |
| 327 | + explicitly whitelist the API port. You can whitelist the API port on all |
| 328 | + interfaces by issuing the following command from a terminal: |
329 | 329 | ```
|
330 |
| - /ip firewall filter |
331 |
| - add place-before=[:pick [find where chain="input"] 0] \ |
332 |
| - chain="input" action="accept" \ |
333 |
| - dst-port=[/ip service get "api" "port"] |
| 330 | + /ip firewall filter add \ |
| 331 | + place-before=[:pick [find where chain="input"] 0] \ |
| 332 | + chain="input" action="accept" \ |
| 333 | + protocol="tcp" dst-port=[/ip service get "api" "port"] |
334 | 334 | ```
|
335 | 335 |
|
336 | 336 | HEREDOC
|
|
0 commit comments