@Clive_A Anyway you can give your scenario and some screenshots?   Clearly, something is different from what I have that you have then.

Probably would be good to have a clarification in the documentation on doing this properly as I would think this would be a fairly common task to pinhole things, but only allow access from specific sources/times/etc.

  @ocbroadband 

I don't have a stand alone router, but this is how you do it with a controller.

RDP IP-Portgroup is only 3389

Allow-RDP have ip which should have access

permit roule have to be over deny roule.

  @MR.S Yea, its pretty much the same, as I've locked it down to a list of Source IP's to allow access to it.  The problem is, when I have it enabled, it still allows addresses outside the allow list to access the port.

  @ocbroadband 

you can't use ipgrup_lan as destination, WAN intefacet doesn't know anything about LAN you have to use IP Port grupe as destinatatioon not your LAN. WAN in doesn't work like that, LAN->WAN YES but not WAN in

Crete a IP-Port group like that, use only port

  @MR.S This device clearly doesn't follow standards in terms of how a firewall works then.

  @ocbroadband 

you can try ipgroup_any on destinton, if you don't want to use port, I don't think ipgroup_lan will work