diff options
| author | Jo-Philipp Wich <jow@openwrt.org> | 2011-06-30 01:31:23 +0000 |
|---|---|---|
| committer | Jo-Philipp Wich <jow@openwrt.org> | 2011-06-30 01:31:23 +0000 |
| commit | 534feb8c9b68db0efcf9e713e90e44e7778bb228 (patch) | |
| tree | 16c0df4e8d376ce0b821752124885dd9195da43c /package/firewall/files/firewall.config | |
| parent | dcd4203ae6099282511e3f27e3611e1143e1c842 (diff) | |
| download | upstream-534feb8c9b68db0efcf9e713e90e44e7778bb228.tar.gz upstream-534feb8c9b68db0efcf9e713e90e44e7778bb228.tar.bz2 upstream-534feb8c9b68db0efcf9e713e90e44e7778bb228.zip | |
[package] firewall:
- allow multiple ports, protocols, macs, icmp types per rule
- implement "limit" and "limit_burst" options for rules
- implement "extra" option to rules and redirects for passing arbritary flags to iptables
- implement negations for "src_port", "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options
- allow wildcard (*) "src" and "dest" options in rules to allow specifying "any" source or destination
- validate symbolic icmp-type names against the selected iptables binary
- properly handle forwarded ICMPv6 traffic in the default configuration
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27317 3c298f89-4303-0410-b956-a3cf2f4a3e73
Diffstat (limited to 'package/firewall/files/firewall.config')
| -rw-r--r-- | package/firewall/files/firewall.config | 61 |
1 files changed, 44 insertions, 17 deletions
diff --git a/package/firewall/files/firewall.config b/package/firewall/files/firewall.config index c852f4b000..c7bc798250 100644 --- a/package/firewall/files/firewall.config +++ b/package/firewall/files/firewall.config @@ -8,23 +8,23 @@ config defaults config zone option name lan - option network 'lan' - option input ACCEPT - option output ACCEPT - option forward REJECT + option network 'lan' + option input ACCEPT + option output ACCEPT + option forward REJECT config zone option name wan - option network 'wan' - option input REJECT - option output ACCEPT - option forward REJECT + option network 'wan' + option input REJECT + option output ACCEPT + option forward REJECT option masq 1 - option mtu_fix 1 + option mtu_fix 1 config forwarding - option src lan - option dest wan + option src lan + option dest wan # We need to accept udp packets on port 68, # see https://dev.openwrt.org/ticket/4108 @@ -33,14 +33,41 @@ config rule option proto udp option dest_port 68 option target ACCEPT - option family ipv4 + option family ipv4 + +# Allow IPv4 ping +config rule + option src wan + option proto icmp + option icmp_type echo-request + option family ipv4 + option target ACCEPT + +# Allow essential incoming IPv6 ICMP traffic +config rule + option src wan + option dest * + option proto icmp + list icmp_type router-solicitation + list icmp_type router-advertisement + list icmp_type neighbour-solicitation + list icmp_type neighbour-advertisement + list icmp_type echo-request + list icmp_type destination-unreachable + list icmp_type packet-too-big + list icmp_type time-exceeded + option limit 1000/sec + option family ipv6 + option target ACCEPT -#Allow ping +# Drop leaking router advertisements on WAN config rule - option src wan - option proto icmp - option icmp_type echo-request - option target ACCEPT + option src * + option dest wan + option proto icmp + option icmp_type router-advertisement + option family ipv6 + option target DROP # include a file with users custom iptables rules config include |