ok, just a n00b trying to learn. here it is for whoever may do a search.
this only allows this ip address though, next step, allowing mail http traffic though
http://www.draytek.co.uk/support/vfaq.html
How can I configure my Vigor to only allow specific IP Address(es) on the Internet access to a Server running on my LAN ?
First you need to allow the incoming traffic through the NAT of your Vigor. See our FAQ here to configure Open Ports.
Next you need to setup IP Filters, firstly to Block the Open Port you have just created above and then to Pass the specific IP Address(es) you want to allow. In the Default Data Filter (Set #2) of your Vigor go into Filter #2 (ignore the first default rule) and setup the following Block Filter:
Enable and Name the Filter
Block If No Further Match
Direction IN
Protocol
Source any
Destination
Destination Start Port
Hit OK and the Vigor is now passing the incoming traffic through NAT, but Blocking it by the above Filter. In Filter #3 set up the following:
Pass rule:
Enable and Name the Filter
Pass Immediately
Direction IN
Protocol
Source
Destination IP
Destination Start Port
Click OK. This Pass Filter will now Pass incoming traffic from the Trusted User on the Internet to the internal Server on the required Port.
