@Hadde 

Hi Hadde,

What's happening is standard for any router, the way to achieve what you want is to local access block others by designating one device as the local administrator by MAC address, this way only one device on your network can access the router login page keeping all other devices off the router admin,

The method is to open Advanced options -> System Tools -> Administration ->  Local Management -> tick the box and add MAC address of the PC or Laptop you want to be the only device to be able to logon to the router then save, I'm guessing you are assuming by leaving the Remote setting disabled this would secure it as you desire, unfortunately not as this is the nature of the beast by design, tip is don't designate your phone and don't use the app unless you really have to, best option is a wired connection to the router,

Once on this page select the local options and add one device by MAC address, then when you go to login again you'll find only the selected device can open the login page, you may want to change the DCHP address as well while you're at it from 192.168.1.1 to anything 192.168.1.(2) through to (99), you can also change the first 1 of the (1).1 end of the addy from 2 to 249 iirc in addition to (2) to (99) in the second 1 of the 1.(1) part of the addy but ensure you miss common numbers used by various router vendors, you can find a list @ Router Security.org in Mike's many sections about locking it down better than what is enabled at the factory, leave it alone if you don't understand the process though, never go above 99 on the last 1 digit or you'll put the router addy in with the DCHP addies, so a typical example will look like this 192.168.174.62 and that should work fine after a reboot,

Some other things you might want to do are to reserve an address outside of the DCHP range ones for that one device, also MAC bind the device in the security section, so you might want to cut your DCHP numbers down  from (192.168.1.100 / 192.168.1.199) to (192.168.1.100 / 192.168.1.140) restricting the router to only give out 40 addresses, then reserve (192.168.1.154) for your admin device, please don't use any of these exact numbers, choose another other than 54, you could also use (192.168.1.126) / (192.168.1.132) this would then only allow 6 devices to connect, use the numbers that work for you, ip address pool section in LAN settings is the place to change these,

Have a read up on Mike's site and you'll find many helpful tips on how to configure routers better, your model the VR600v is a very good budget option which has many features that a lot of other routers 50% more expensive don't have, TP-L could be a bit better with their explainations of things and keep FW updated more regularly but overall still a good choice. hth.

@Kevin_Z Thanks for your reply. Like you mentioned was this the solution, when I am in my local network, i can access the web UI with the global IP address or the DDNS. Switching to another network, like using LTE from my phone or when i am at work, and I can't access the web UI anymore. So everything is working like aspected :-).

@Hadde 

I've just had to edit so if you read earlier please read again as some things I've had to add for info and another was because I'd posted an incorrect set of ip numbers, the ones now posted are correct though.

@Hannibal_Lack Thanks for your reply and time :-). I will have a look at Mike's site. I already changed the local ip address of the router and the dhcp range.

@Hadde 

NP,

I thought you were having an issue of any device could login to the UI, I see now it was a bit more complex than that, glad you got it sorted out in the end.