firewall.config 4.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194
  1. config defaults
  2. option syn_flood 1
  3. option input ACCEPT
  4. option output ACCEPT
  5. option forward REJECT
  6. # Uncomment this line to disable ipv6 rules
  7. # option disable_ipv6 1
  8. config zone
  9. option name lan
  10. list network 'lan'
  11. option input ACCEPT
  12. option output ACCEPT
  13. option forward ACCEPT
  14. config zone
  15. option name wan
  16. list network 'wan'
  17. list network 'wan6'
  18. option input REJECT
  19. option output ACCEPT
  20. option forward REJECT
  21. option masq 1
  22. option mtu_fix 1
  23. config forwarding
  24. option src lan
  25. option dest wan
  26. # We need to accept udp packets on port 68,
  27. # see https://dev.openwrt.org/ticket/4108
  28. config rule
  29. option name Allow-DHCP-Renew
  30. option src wan
  31. option proto udp
  32. option dest_port 68
  33. option target ACCEPT
  34. option family ipv4
  35. # Allow IPv4 ping
  36. config rule
  37. option name Allow-Ping
  38. option src wan
  39. option proto icmp
  40. option icmp_type echo-request
  41. option family ipv4
  42. option target ACCEPT
  43. config rule
  44. option name Allow-IGMP
  45. option src wan
  46. option proto igmp
  47. option family ipv4
  48. option target ACCEPT
  49. # Allow DHCPv6 replies
  50. # see https://dev.openwrt.org/ticket/10381
  51. config rule
  52. option name Allow-DHCPv6
  53. option src wan
  54. option proto udp
  55. option src_ip fc00::/6
  56. option dest_ip fc00::/6
  57. option dest_port 546
  58. option family ipv6
  59. option target ACCEPT
  60. config rule
  61. option name Allow-MLD
  62. option src wan
  63. option proto icmp
  64. option src_ip fe80::/10
  65. list icmp_type '130/0'
  66. list icmp_type '131/0'
  67. list icmp_type '132/0'
  68. list icmp_type '143/0'
  69. option family ipv6
  70. option target ACCEPT
  71. # Allow essential incoming IPv6 ICMP traffic
  72. config rule
  73. option name Allow-ICMPv6-Input
  74. option src wan
  75. option proto icmp
  76. list icmp_type echo-request
  77. list icmp_type echo-reply
  78. list icmp_type destination-unreachable
  79. list icmp_type packet-too-big
  80. list icmp_type time-exceeded
  81. list icmp_type bad-header
  82. list icmp_type unknown-header-type
  83. list icmp_type router-solicitation
  84. list icmp_type neighbour-solicitation
  85. list icmp_type router-advertisement
  86. list icmp_type neighbour-advertisement
  87. option limit 1000/sec
  88. option family ipv6
  89. option target ACCEPT
  90. # Allow essential forwarded IPv6 ICMP traffic
  91. config rule
  92. option name Allow-ICMPv6-Forward
  93. option src wan
  94. option dest *
  95. option proto icmp
  96. list icmp_type echo-request
  97. list icmp_type echo-reply
  98. list icmp_type destination-unreachable
  99. list icmp_type packet-too-big
  100. list icmp_type time-exceeded
  101. list icmp_type bad-header
  102. list icmp_type unknown-header-type
  103. option limit 1000/sec
  104. option family ipv6
  105. option target ACCEPT
  106. # include a file with users custom iptables rules
  107. config include
  108. option path /etc/firewall.user
  109. ### EXAMPLE CONFIG SECTIONS
  110. # do not allow a specific ip to access wan
  111. #config rule
  112. # option src lan
  113. # option src_ip 192.168.45.2
  114. # option dest wan
  115. # option proto tcp
  116. # option target REJECT
  117. # block a specific mac on wan
  118. #config rule
  119. # option dest wan
  120. # option src_mac 00:11:22:33:44:66
  121. # option target REJECT
  122. # block incoming ICMP traffic on a zone
  123. #config rule
  124. # option src lan
  125. # option proto ICMP
  126. # option target DROP
  127. # port redirect port coming in on wan to lan
  128. #config redirect
  129. # option src wan
  130. # option src_dport 80
  131. # option dest lan
  132. # option dest_ip 192.168.16.235
  133. # option dest_port 80
  134. # option proto tcp
  135. # port redirect of remapped ssh port (22001) on wan
  136. #config redirect
  137. # option src wan
  138. # option src_dport 22001
  139. # option dest lan
  140. # option dest_port 22
  141. # option proto tcp
  142. # allow IPsec/ESP and ISAKMP passthrough
  143. config rule
  144. option src wan
  145. option dest lan
  146. option proto esp
  147. option target ACCEPT
  148. config rule
  149. option src wan
  150. option dest lan
  151. option dest_port 500
  152. option proto udp
  153. option target ACCEPT
  154. ### FULL CONFIG SECTIONS
  155. #config rule
  156. # option src lan
  157. # option src_ip 192.168.45.2
  158. # option src_mac 00:11:22:33:44:55
  159. # option src_port 80
  160. # option dest wan
  161. # option dest_ip 194.25.2.129
  162. # option dest_port 120
  163. # option proto tcp
  164. # option target REJECT
  165. #config redirect
  166. # option src lan
  167. # option src_ip 192.168.45.2
  168. # option src_mac 00:11:22:33:44:55
  169. # option src_port 1024
  170. # option src_dport 80
  171. # option dest_ip 194.25.2.129
  172. # option dest_port 120
  173. # option proto tcp