Can Linksys BEFSR41 v.1 restrict certain ports per user?

I am a networking novice, and I suspect that my desired end result is
beyond the capabilities of this router.

I want to control which ports certain LAN users can communicate over.
The intent is to allow certain users access to an Internet email server
but to deny any HTTP requests.

Can this router allow ports 25 and 110 while blocking port 80, for a
certain IP or MAC address?

I'd like to get this little router to do it, short of doing via a Linux
system or something.

Thanks,
TK

You are correct. The BEFSR41 (I have several) allows you to block all
ports for selected IPs and to block selected ports for all IPs. You
cannot choose to block some ports for some IPs.

See the Advanced Filtering information in the manual.

You may be able to achieve your goals with a more expensive router or
by employing two BEFSR41s, one for the restricted IPs and one for the
rest. You can cascade them.


DevNull wrote:
> I am a networking novice, and I suspect that my desired end result is
> beyond the capabilities of this router.
>
> I want to control which ports certain LAN users can communicate over.
> The intent is to allow certain users access to an Internet email server
> but to deny any HTTP requests.
>
> Can this router allow ports 25 and 110 while blocking port 80, for a
> certain IP or MAC address?
>
> I'd like to get this little router to do it, short of doing via a Linux
> system or something.
>
> Thanks,
> TK

Thanks for the good info!

I read a post today that got me a little confused on this issue...
Does the router block access to ports requested from outside the LAN,
or from inside?

For example, if I block port 80 in the router for all IPs on my LAN,
does that
1. restrict LAN workstations from hitting port 80 on any Internet web
server,
or
2. restrict any request for port 80 from the Internet to a web server
on my LAN?

I understood the first case to be how the router works, but a post I
read today said the second is the case. My understanding was that #1
is performed by a router, and #2 is performed by a firewall. But the
router can act as a sort of firewall, right?

I presumed that a workstation made a request from a local port 80 to a
server's port 80 when viewing a web page, but apparently that's not the
case...?



Harry wrote:
> You are correct. The BEFSR41 (I have several) allows you to block all
> ports for selected IPs and to block selected ports for all IPs. You
> cannot choose to block some ports for some IPs.
>
> See the Advanced Filtering information in the manual.
>
> You may be able to achieve your goals with a more expensive router or
> by employing two BEFSR41s, one for the restricted IPs and one for the
> rest. You can cascade them.
>
>
> DevNull wrote:
> > I am a networking novice, and I suspect that my desired end result is
> > beyond the capabilities of this router.
> >
> > I want to control which ports certain LAN users can communicate over.
> > The intent is to allow certain users access to an Internet email server
> > but to deny any HTTP requests.
> >
> > Can this router allow ports 25 and 110 while blocking port 80, for a
> > certain IP or MAC address?
> >
> > I'd like to get this little router to do it, short of doing via a Linux
> > system or something.
> >
> > Thanks,
> > TK

The Filtering page is intended to prevent LAN users from utilizing
certain services or to block LAN users from Internet access totally.

Your router is a firewall because it can be invisible to pings if you
so choose and because it can ignore any port and can forward any port
to a specified machine. Some also have SPI to prevent certain DoS
attacks. These features are not "filtering." I have no idea where
this terminology originated -- it does cause confusion.

You hide from pings by enabling "Block WAN Request" on the Filtering
page.

The Forwarding page handles ordinary port forwarding. Unless you
enable DMZ (not recommended), the only ports outsiders can see are
those you set up here. If you have a web server, you must forward port
80 to it. If you don't, just keep port 80 closed.

Hope this clears up the confusion created by unclear manuals, odd
terminology and other obfuscations of the router industry.