Because it's a firewall and by default WAN access is blocked to stop naughty people gaining access to the management interface. Strange that....