Hi Travis and welcome to Digi Forum.
In order to block/allow specific traffic on a WR11, you can add specific firewall rules on top of the default ones (or in substitution of those).
As an example of a rule to allow specific traffic:
pass in break end on PPP 1 proto tcp from any to any port=1883
And you can specify also specific source/destination addresses if needed and replicate the rule for different ports depending on the protocols you want to allow.
If you enable the firewall only on the PPP 1, then you will be able to access it via ETH 0 without any restrictions. If instead you want to block all also on ETH 0 except for the management, you need to enable the firewall also on ETH 0 and add a rule like this (example for HTTP management):
pass in break end on eth 0 from 192.168.1.0/24 to addr-eth 0 port=80
The above are general examples, but you can find more details on the SarOS user guide, Firewall section: https://www.digi.com/resources/documentation/digidocs/90001019/Default.htm#references/r_firewall.htm
For any further help, please review our support options on our website: https://www.digi.com/support.
Digi Technical Support Team