From 244b5fcbdb2795a5cf3a396445551fa3fee8e75d Mon Sep 17 00:00:00 2001 From: Jo-Philipp Wich Date: Mon, 2 May 2011 12:54:31 +0000 Subject: [PATCH] firewall: provide examples of ssh port relocation on firewall and IPsec passthrough Two examples of potentially useful configurations (commented out, of course): (a) map the ssh service running on the firewall to 22001 externally, without modifying the configuration of the daemon itself. this allows port 22 on the WAN side to then be port-forwarded to a LAN-based machine if desired, or if not, simply obscures the port from external attack. (b) allow IPsec/ESP and ISAKMP (UDP-based key exchange) to happen by default. useful for most modern VPN clients you might have on your WAN. Signed-off-by: Philip Prindeville git-svn-id: svn://svn.openwrt.org/openwrt/trunk@26805 3c298f89-4303-0410-b956-a3cf2f4a3e73 --- package/firewall/files/firewall.config | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) (limited to 'package/firewall/files/firewall.config') diff --git a/package/firewall/files/firewall.config b/package/firewall/files/firewall.config index 7904cedb87..bee162549e 100644 --- a/package/firewall/files/firewall.config +++ b/package/firewall/files/firewall.config @@ -75,6 +75,28 @@ config include # option dest_port 80 # option proto tcp +# port redirect of remapped ssh port (22001) on wan +#config redirect +# option src wan +# option src_dport 22001 +# option dest lan +# option dest_port 22 +# option proto tcp + +# allow IPsec/ESP and ISAKMP passthrough +#config rule +# option src wan +# option dest lan +# option protocol esp +# option target ACCEPT + +#config rule +# option src wan +# option dest lan +# option src_port 500 +# option dest_port 500 +# option proto udp +# option target ACCEPT ### FULL CONFIG SECTIONS #config rule -- cgit v1.2.3