mirror of
git://projects.qi-hardware.com/openwrt-xburst.git
synced 2024-11-27 23:39:41 +02:00
87281df903
- allow multiple ports, protocols, macs, icmp types per rule - implement "limit" and "limit_burst" options for rules - implement "extra" option to rules and redirects for passing arbritary flags to iptables - implement negations for "src_port", "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options - allow wildcard (*) "src" and "dest" options in rules to allow specifying "any" source or destination - validate symbolic icmp-type names against the selected iptables binary - properly handle forwarded ICMPv6 traffic in the default configuration git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27317 3c298f89-4303-0410-b956-a3cf2f4a3e73
151 lines
3.1 KiB
Plaintext
151 lines
3.1 KiB
Plaintext
config defaults
|
|
option syn_flood 1
|
|
option input ACCEPT
|
|
option output ACCEPT
|
|
option forward REJECT
|
|
# Uncomment this line to disable ipv6 rules
|
|
# option disable_ipv6 1
|
|
|
|
config zone
|
|
option name lan
|
|
option network 'lan'
|
|
option input ACCEPT
|
|
option output ACCEPT
|
|
option forward REJECT
|
|
|
|
config zone
|
|
option name wan
|
|
option network 'wan'
|
|
option input REJECT
|
|
option output ACCEPT
|
|
option forward REJECT
|
|
option masq 1
|
|
option mtu_fix 1
|
|
|
|
config forwarding
|
|
option src lan
|
|
option dest wan
|
|
|
|
# We need to accept udp packets on port 68,
|
|
# see https://dev.openwrt.org/ticket/4108
|
|
config rule
|
|
option src wan
|
|
option proto udp
|
|
option dest_port 68
|
|
option target ACCEPT
|
|
option family ipv4
|
|
|
|
# Allow IPv4 ping
|
|
config rule
|
|
option src wan
|
|
option proto icmp
|
|
option icmp_type echo-request
|
|
option family ipv4
|
|
option target ACCEPT
|
|
|
|
# Allow essential incoming IPv6 ICMP traffic
|
|
config rule
|
|
option src wan
|
|
option dest *
|
|
option proto icmp
|
|
list icmp_type router-solicitation
|
|
list icmp_type router-advertisement
|
|
list icmp_type neighbour-solicitation
|
|
list icmp_type neighbour-advertisement
|
|
list icmp_type echo-request
|
|
list icmp_type destination-unreachable
|
|
list icmp_type packet-too-big
|
|
list icmp_type time-exceeded
|
|
option limit 1000/sec
|
|
option family ipv6
|
|
option target ACCEPT
|
|
|
|
# Drop leaking router advertisements on WAN
|
|
config rule
|
|
option src *
|
|
option dest wan
|
|
option proto icmp
|
|
option icmp_type router-advertisement
|
|
option family ipv6
|
|
option target DROP
|
|
|
|
# include a file with users custom iptables rules
|
|
config include
|
|
option path /etc/firewall.user
|
|
|
|
|
|
### EXAMPLE CONFIG SECTIONS
|
|
# do not allow a specific ip to access wan
|
|
#config rule
|
|
# option src lan
|
|
# option src_ip 192.168.45.2
|
|
# option dest wan
|
|
# option proto tcp
|
|
# option target REJECT
|
|
|
|
# block a specific mac on wan
|
|
#config rule
|
|
# option dest wan
|
|
# option src_mac 00:11:22:33:44:66
|
|
# option target REJECT
|
|
|
|
# block incoming ICMP traffic on a zone
|
|
#config rule
|
|
# option src lan
|
|
# option proto ICMP
|
|
# option target DROP
|
|
|
|
# port redirect port coming in on wan to lan
|
|
#config redirect
|
|
# option src wan
|
|
# option src_dport 80
|
|
# option dest lan
|
|
# option dest_ip 192.168.16.235
|
|
# option dest_port 80
|
|
# option proto tcp
|
|
|
|
# port redirect of remapped ssh port (22001) on wan
|
|
#config redirect
|
|
# option src wan
|
|
# option src_dport 22001
|
|
# option dest lan
|
|
# option dest_port 22
|
|
# option proto tcp
|
|
|
|
# allow IPsec/ESP and ISAKMP passthrough
|
|
#config rule
|
|
# option src wan
|
|
# option dest lan
|
|
# option protocol esp
|
|
# option target ACCEPT
|
|
|
|
#config rule
|
|
# option src wan
|
|
# option dest lan
|
|
# option src_port 500
|
|
# option dest_port 500
|
|
# option proto udp
|
|
# option target ACCEPT
|
|
|
|
### FULL CONFIG SECTIONS
|
|
#config rule
|
|
# option src lan
|
|
# option src_ip 192.168.45.2
|
|
# option src_mac 00:11:22:33:44:55
|
|
# option src_port 80
|
|
# option dest wan
|
|
# option dest_ip 194.25.2.129
|
|
# option dest_port 120
|
|
# option proto tcp
|
|
# option target REJECT
|
|
|
|
#config redirect
|
|
# option src lan
|
|
# option src_ip 192.168.45.2
|
|
# option src_mac 00:11:22:33:44:55
|
|
# option src_port 1024
|
|
# option src_dport 80
|
|
# option dest_ip 194.25.2.129
|
|
# option dest_port 120
|
|
# option proto tcp
|