1
0

firewall.config 4.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195
  1. config defaults
  2. option syn_flood 1
  3. option input ACCEPT
  4. option output ACCEPT
  5. option forward REJECT
  6. # Uncomment this line to disable ipv6 rules
  7. # option disable_ipv6 1
  8. config zone
  9. option name lan
  10. list network 'lan'
  11. option input ACCEPT
  12. option output ACCEPT
  13. option forward ACCEPT
  14. config zone
  15. option name wan
  16. list network 'wan'
  17. list network 'wan6'
  18. option input REJECT
  19. option output ACCEPT
  20. option forward REJECT
  21. option masq 1
  22. option mtu_fix 1
  23. config forwarding
  24. option src lan
  25. option dest wan
  26. # We need to accept udp packets on port 68,
  27. # see https://dev.openwrt.org/ticket/4108
  28. config rule
  29. option name Allow-DHCP-Renew
  30. option src wan
  31. option proto udp
  32. option dest_port 68
  33. option target ACCEPT
  34. option family ipv4
  35. # Allow IPv4 ping
  36. config rule
  37. option name Allow-Ping
  38. option src wan
  39. option proto icmp
  40. option icmp_type echo-request
  41. option family ipv4
  42. option target ACCEPT
  43. config rule
  44. option name Allow-IGMP
  45. option src wan
  46. option proto igmp
  47. option family ipv4
  48. option target ACCEPT
  49. # Allow DHCPv6 replies
  50. # see https://dev.openwrt.org/ticket/10381
  51. config rule
  52. option name Allow-DHCPv6
  53. option src wan
  54. option proto udp
  55. option src_ip fc00::/6
  56. option dest_ip fc00::/6
  57. option dest_port 546
  58. option family ipv6
  59. option target ACCEPT
  60. config rule
  61. option name Allow-MLD
  62. option src wan
  63. option proto icmp
  64. option src_ip fe80::/10
  65. list icmp_type '130/0'
  66. list icmp_type '131/0'
  67. list icmp_type '132/0'
  68. list icmp_type '143/0'
  69. option family ipv6
  70. option target ACCEPT
  71. # Allow essential incoming IPv6 ICMP traffic
  72. config rule
  73. option name Allow-ICMPv6-Input
  74. option src wan
  75. option proto icmp
  76. list icmp_type echo-request
  77. list icmp_type echo-reply
  78. list icmp_type destination-unreachable
  79. list icmp_type packet-too-big
  80. list icmp_type time-exceeded
  81. list icmp_type bad-header
  82. list icmp_type unknown-header-type
  83. list icmp_type router-solicitation
  84. list icmp_type neighbour-solicitation
  85. list icmp_type router-advertisement
  86. list icmp_type neighbour-advertisement
  87. option limit 1000/sec
  88. option family ipv6
  89. option target ACCEPT
  90. # Allow essential forwarded IPv6 ICMP traffic
  91. config rule
  92. option name Allow-ICMPv6-Forward
  93. option src wan
  94. option dest *
  95. option proto icmp
  96. list icmp_type echo-request
  97. list icmp_type echo-reply
  98. list icmp_type destination-unreachable
  99. list icmp_type packet-too-big
  100. list icmp_type time-exceeded
  101. list icmp_type bad-header
  102. list icmp_type unknown-header-type
  103. option limit 1000/sec
  104. option family ipv6
  105. option target ACCEPT
  106. config rule
  107. option name Allow-IPSec-ESP
  108. option src wan
  109. option dest lan
  110. option proto esp
  111. option target ACCEPT
  112. config rule
  113. option name Allow-ISAKMP
  114. option src wan
  115. option dest lan
  116. option dest_port 500
  117. option proto udp
  118. option target ACCEPT
  119. # include a file with users custom iptables rules
  120. config include
  121. option path /etc/firewall.user
  122. ### EXAMPLE CONFIG SECTIONS
  123. # do not allow a specific ip to access wan
  124. #config rule
  125. # option src lan
  126. # option src_ip 192.168.45.2
  127. # option dest wan
  128. # option proto tcp
  129. # option target REJECT
  130. # block a specific mac on wan
  131. #config rule
  132. # option dest wan
  133. # option src_mac 00:11:22:33:44:66
  134. # option target REJECT
  135. # block incoming ICMP traffic on a zone
  136. #config rule
  137. # option src lan
  138. # option proto ICMP
  139. # option target DROP
  140. # port redirect port coming in on wan to lan
  141. #config redirect
  142. # option src wan
  143. # option src_dport 80
  144. # option dest lan
  145. # option dest_ip 192.168.16.235
  146. # option dest_port 80
  147. # option proto tcp
  148. # port redirect of remapped ssh port (22001) on wan
  149. #config redirect
  150. # option src wan
  151. # option src_dport 22001
  152. # option dest lan
  153. # option dest_port 22
  154. # option proto tcp
  155. ### FULL CONFIG SECTIONS
  156. #config rule
  157. # option src lan
  158. # option src_ip 192.168.45.2
  159. # option src_mac 00:11:22:33:44:55
  160. # option src_port 80
  161. # option dest wan
  162. # option dest_ip 194.25.2.129
  163. # option dest_port 120
  164. # option proto tcp
  165. # option target REJECT
  166. #config redirect
  167. # option src lan
  168. # option src_ip 192.168.45.2
  169. # option src_mac 00:11:22:33:44:55
  170. # option src_port 1024
  171. # option src_dport 80
  172. # option dest_ip 194.25.2.129
  173. # option dest_port 120
  174. # option proto tcp