Home Explore Help
Register Sign In
OpenWrt
/
openwrt
mirror of https://github.com/openwrt/openwrt.git
2
0
Fork 0
Files Issues 0 Wiki
Tree: 04b20727d8
Branches Tags
openwrt
/
package
/
firewall
/
files
/
firewall.config

firewall.config 1.9 KB
History Raw

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899 
  1. config defaults
    2. 

  2. 	option syn_flood	1
    3. 

  3. 	option input		ACCEPT
    4. 

  4. 	option output		ACCEPT 
    5. 

  5. 	option forward		REJECT
    6. 

  6. # Uncomment this line to disable ipv6 rules
    7. 

  7. #	option disable_ipv6	1
    8. 

  8. 

  9. config zone
    10. 

  10. 	option name		lan
    11. 

  11. 	option input	ACCEPT 
    12. 

  12. 	option output	ACCEPT 
    13. 

  13. 	option forward	REJECT
    14. 

  14. 

  15. config zone
    16. 

  16. 	option name		wan
    17. 

  17. 	option input	REJECT
    18. 

  18. 	option output	ACCEPT 
    19. 

  19. 	option forward	REJECT
    20. 

  20. 	option masq		1 
    21. 

  21. 	option mtu_fix	1
    22. 

  22. 

  23. config forwarding 
    24. 

  24. 	option src      lan
    25. 

  25. 	option dest     wan
    26. 

  26. 

  27. # We need to accept udp packets on port 68,
    28. 

  28. # see https://dev.openwrt.org/ticket/4108
    29. 

  29. config rule
    30. 

  30. 	option src		wan
    31. 

  31. 	option proto		udp
    32. 

  32. 	option dest_port	68
    33. 

  33. 	option target		ACCEPT
    34. 

  34. 	option family	ipv4
    35. 

  35. 

  36. #Allow ping
    37. 

  37. config rule
    38. 

  38. 	option src wan
    39. 

  39. 	option proto icmp
    40. 

  40. 	option icmp_type echo-request
    41. 

  41. 	option target ACCEPT
    42. 

  42. 

  43. # include a file with users custom iptables rules
    44. 

  44. config include
    45. 

  45. 	option path /etc/firewall.user
    46. 

  46. 

  47. 

  48. ### EXAMPLE CONFIG SECTIONS
    49. 

  49. # do not allow a specific ip to access wan
    50. 

  50. #config rule
    51. 

  51. #	option src		lan
    52. 

  52. #	option src_ip	192.168.45.2
    53. 

  53. #	option dest		wan
    54. 

  54. #	option proto	tcp
    55. 

  55. #	option target	REJECT 
    56. 

  56. 

  57. # block a specific mac on wan
    58. 

  58. #config rule
    59. 

  59. #	option dest		wan
    60. 

  60. #	option src_mac	00:11:22:33:44:66
    61. 

  61. #	option target	REJECT 
    62. 

  62. 

  63. # block incoming ICMP traffic on a zone
    64. 

  64. #config rule
    65. 

  65. #	option src		lan
    66. 

  66. #	option proto	ICMP
    67. 

  67. #	option target	DROP
    68. 

  68. 

  69. # port redirect port coming in on wan to lan
    70. 

  70. #config redirect
    71. 

  71. #	option src			wan
    72. 

  72. #	option src_dport	80
    73. 

  73. #	option dest			lan
    74. 

  74. #	option dest_ip		192.168.16.235
    75. 

  75. #	option dest_port	80 
    76. 

  76. #	option proto		tcp
    77. 

  77. 

  78. 

  79. ### FULL CONFIG SECTIONS
    80. 

  80. #config rule
    81. 

  81. #	option src		lan
    82. 

  82. #	option src_ip	192.168.45.2
    83. 

  83. #	option src_mac	00:11:22:33:44:55
    84. 

  84. #	option src_port	80
    85. 

  85. #	option dest		wan
    86. 

  86. #	option dest_ip	194.25.2.129
    87. 

  87. #	option dest_port	120
    88. 

  88. #	option proto	tcp
    89. 

  89. #	option target	REJECT 
    90. 

  90. 

  91. #config redirect
    92. 

  92. #	option src		lan
    93. 

  93. #	option src_ip	192.168.45.2
    94. 

  94. #	option src_mac	00:11:22:33:44:55
    95. 

  95. #	option src_port		1024
    96. 

  96. #	option src_dport	80
    97. 

  97. #	option dest_ip	194.25.2.129
    98. 

  98. #	option dest_port	120
    99. 

  99. #	option proto	tcp
    100.