WRT54G: How do I limit access to specific ports, only to local IP's

Question

Using a WRT54G with Windows XP, and I've setup a web server that I'm still testing. Until I understand the security better, I want to limit access from outside IP's to the port that it's running on, but NOT limit access from the outside to services running on other ports. Is there a way to block a range of IP addresses (or conversely, only permit access for a limited range of IP addresses) to a specific port? So for example (assuming server's on Port 99, and IP address to the outside world is 99.99.99.99: Port 99: Blocked IP Range: 0.0.0.0-99.99.99.98, and 99.99.99.100-255.255.255.255 - OR Port 99: Allowed IP Range: 99.99.99.99 Alternatively, I would be interested to permit access to the web server port, only for certain MAC addresses. Is this pretty secure, and if so, how can this be done? I've poked around the router settings and spent a good deal of time researching this; any help would be greatly appreciated...

Answer 1

Why do you want to block IP addresses:  "IP Range: 0.0.0.0-99.99.99.98, and 99.99.99.100-255.255.255.255" ?   This is everybody on the web, except your router!    If you really want to block all these people, just unplug your router from your Internet connection.  That is a block that cannot be hacked!
Normally a server is assigned a fixed LAN IP address.  This address must be outside the DHCP server range of your router, and it cannot end in 0, 1, or 255.
Next you forward a port (for example, 99) to the server's fixed LAN IP address.
Data arriving at the Internet port of your WRT54G for port 99 will then be forwarded to your server.  If you have other Internet services (i.e. server B) running on port 1297, then data that arrives at the Internet port of your WRT54G for port 1297 will be directed to server B.   Assuming that you only have port 99 and port 1297 open, then any other unrequested data (for any other port) that arrives at the Internet port of your WRT54G will simply be ignored (and thereby blocked).    If you connect another computer to a LAN port of the WRT54G, connect to the Internet, and request data, then when that data arrives at the Internet port of the WRT54G, it will be allowed to pass, and it will be routed to your computer.
In summary, by default, all router ports are closed.  The only way to get data through the router is either to open a port (using port forwarding, or alternatively, the UPnP function), or for someone (or some program) on the LAN to request data from the web.
The router cannot limit the use of a port by MAC address.    When you open a port on your router, you are opening your server to invasion from anyone on the Internet.  So, your server must be setup to protect itself.   Rather than limiting server use by MAC address (which can be faked), your server should be setup to require a user name and password.