From 534feb8c9b68db0efcf9e713e90e44e7778bb228 Mon Sep 17 00:00:00 2001
From: Jo-Philipp Wich <jow@openwrt.org>
Date: Thu, 30 Jun 2011 01:31:23 +0000
Subject: [package] firewall: 	- allow multiple ports, protocols, macs, icmp
 types per rule 	- implement "limit" and "limit_burst" options for
 rules 	- implement "extra" option to rules and redirects for passing
 arbritary flags to iptables 	- implement negations for "src_port",
 "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options 	-
 allow wildcard (*) "src" and "dest" options in rules to allow specifying
 "any" source or destination 	- validate symbolic icmp-type names against
 the selected iptables binary 	- properly handle forwarded ICMPv6 traffic in
 the default configuration

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27317 3c298f89-4303-0410-b956-a3cf2f4a3e73
---
 package/firewall/files/firewall.config | 61 ++++++++++++++++++++++++----------
 1 file changed, 44 insertions(+), 17 deletions(-)

(limited to 'package/firewall/files/firewall.config')

diff --git a/package/firewall/files/firewall.config b/package/firewall/files/firewall.config
index c852f4b000..c7bc798250 100644
--- a/package/firewall/files/firewall.config
+++ b/package/firewall/files/firewall.config
@@ -8,23 +8,23 @@ config defaults
 
 config zone
 	option name		lan
-	option network	'lan'
-	option input	ACCEPT 
-	option output	ACCEPT 
-	option forward	REJECT
+	option network		'lan'
+	option input		ACCEPT 
+	option output		ACCEPT 
+	option forward		REJECT
 
 config zone
 	option name		wan
-	option network	'wan'
-	option input	REJECT
-	option output	ACCEPT 
-	option forward	REJECT
+	option network		'wan'
+	option input		REJECT
+	option output		ACCEPT 
+	option forward		REJECT
 	option masq		1 
-	option mtu_fix	1
+	option mtu_fix		1
 
 config forwarding 
-	option src      lan
-	option dest     wan
+	option src      	lan
+	option dest     	wan
 
 # We need to accept udp packets on port 68,
 # see https://dev.openwrt.org/ticket/4108
@@ -33,14 +33,41 @@ config rule
 	option proto		udp
 	option dest_port	68
 	option target		ACCEPT
-	option family	ipv4
+	option family		ipv4
+
+# Allow IPv4 ping
+config rule
+	option src		wan
+	option proto		icmp
+	option icmp_type	echo-request
+	option family		ipv4
+	option target		ACCEPT
+
+# Allow essential incoming IPv6 ICMP traffic
+config rule                                   
+	option src		wan
+	option dest		*
+	option proto		icmp
+	list icmp_type		router-solicitation
+	list icmp_type		router-advertisement
+	list icmp_type		neighbour-solicitation
+	list icmp_type		neighbour-advertisement
+	list icmp_type		echo-request
+	list icmp_type		destination-unreachable
+	list icmp_type		packet-too-big
+	list icmp_type		time-exceeded
+	option limit		1000/sec
+	option family		ipv6
+	option target		ACCEPT
 
-#Allow ping
+# Drop leaking router advertisements on WAN
 config rule
-	option src wan
-	option proto icmp
-	option icmp_type echo-request
-	option target ACCEPT
+	option src		*
+	option dest		wan
+	option proto		icmp
+	option icmp_type	router-advertisement
+	option family		ipv6
+	option target		DROP
 
 # include a file with users custom iptables rules
 config include
-- 
cgit v1.2.3