ssh access

[tdalej]

It seems in the gui the ability to enable ssh access is global and I don't see anything that is interface specific.
Is the WAN interface disabled for ssh access by default?

[Patrick M. Hausen]

The WAN interface blocks all incoming connections by default by firewall rules, so services listening to all interfaces is not a security concern and is generally the recommended way to run e.g. SSH, Unbound, etc.

[dseven]

I don't disagree with Patrick, but [System -> Settings -> Administration -> Secure Shell -> Listen Interfaces] is a thing....

[tdalej]

So:
WAN blocked by default
LANS have access by default

I need to block access from some LANs I need to create firewall rules.

[EricPerl]

Only the default LAN interface was given an allow any to any rule (IPv4 and IPv6).
If this is not appropriate, you can curtail this further.
Additional interfaces get no default rules, just the minimal automatically generated rules (up to DHCP).

You don't necessarily need to block anything if you didn't allow more than needed (and if you did, you can be more granular).