@shberge Thank you for the explanation. And you're right! So in my case it was my fault.

@shberge In my case I tried via dyndns. So it should be from WAN?

OK, now I configured NAT for ports 80 and 443 and it's working like expected. Router or even Omada SDN aren't accessible. But the default config seems to be vulnerable!

Noticed exact the same behaviour in my new config: ER605, SG2008p, EAP245 managed by local Omada controller. How can we deny access from wan?! There aren't any forwarded ports yet - it's still in...