Sorry, I thought I had listed it. It is a DIR-655. Windows documentation says to use Windows Firewall, but I'd rather block port 3389 at the router. I've seen a lot of internet posts about NOT being able to login from the WAN, but I want the opposite, to block it completely. I have experimented and I can login from the LAN, but I need to know if I have to do something to block the WAN. Apparently port forwarding is needed to unblock the WAN, implying the default is blocked. Is that correct?