To prevent exposing your device from WAN, which is the default, get to the GUI or SSH locally and run these commands. Change the addresses as needed.
configure set service gui listen-address 192.168.20.1 set service ssh listen-address 192.168.20.1 commit save exit