AX23 wireguard client - firewall does not protect LAN/UI/dnsmasq for incoming connections over VPN
Hi,
I configured wireguard vpn client on TP-Link Archer AX23 V2 running firmware 1.1.2 Build 20250814 rel.14122(4555) and discovered the following security problems:
1. router's LAN is not protected for incoming traffic through the wireguard tunnel regardless of the 'NAT Enabled' setting in the vpn client configuration.
The only difference is: with 'NAT Enabled = YES' the source IP address of connections originated from the router's LAN is the wireguard client IP address (masquerade), while with 'NAT Enabled = NO' the source IP is the LAN client IP address.
2. router's http/https UI and dnsmasq server are always accessible over the VPN tunnel, also with 'NAT Enabled = YES'. I did not find firewall settings in the router's UI allowing filtering incoming traffic over vpn.
Is it possible to configure firewall for incoming traffic over wireguard vpn ? If not, please add to firmware the firewall configuration options for vpn.
