package/firewall/files/firewall.config

   1 config defaults
   2         option syn_flood        1
   3         option input            ACCEPT
   4         option output           ACCEPT
   5         option forward          REJECT
   6
   7 config zone
   8         option name             lan
   9         option input    ACCEPT
  10         option output   ACCEPT
  11         option forward  REJECT
  12
  13 config zone
  14         option name             wan
  15         option input    REJECT
  16         option output   ACCEPT
  17         option forward  REJECT
  18         option masq             1
  19
  20 config forwarding
  21         option src      lan
  22         option dest     wan
  23
  24 ## Enable this option if you encounter any MTU problems
  25 ## e.g. some websites work, others do not, submitting
  26 ## forms causes problems, ...
  27 #       option mtu_fix  1
  28
  29
  30 ### EXAMPLE CONFIG SECTIONS
  31 # do not allow a specific ip to access wan
  32 #config rule
  33 #       option src              lan
  34 #       option src_ip   192.168.45.2
  35 #       option dest             wan
  36 #       option proto    tcp
  37 #       option target   REJECT
  38
  39 # block a specific mac on wan
  40 #config rule
  41 #       option dest             wan
  42 #       option src_mac  00:11:22:33:44:66
  43 #       option target   REJECT
  44
  45 # block incoming ICMP traffic on a zone
  46 #config rule
  47 #       option src              lan
  48 #       option proto    ICMP
  49 #       option target   DROP
  50
  51 # port redirect port coming in on wan to lan
  52 #config redirect
  53 #       option src                      wan
  54 #       option src_dport        80
  55 #       option dest                     lan
  56 #       option dest_ip          192.168.16.235
  57 #       option dest_port        80
  58 #       option proto            tcp
  59
  60 # include a file with users custom iptables rules
  61 #config include
  62 #       option path /etc/firewall.user
  63
  64
  65 ### FULL CONFIG SECTIONS
  66 #config rule
  67 #       option src              lan
  68 #       option src_ip   192.168.45.2
  69 #       option src_mac  00:11:22:33:44:55
  70 #       option src_port 80
  71 #       option dest             wan
  72 #       option dest_ip  194.25.2.129
  73 #       option dest_port        120
  74 #       option proto    tcp
  75 #       option target   REJECT
  76
  77 #config redirect
  78 #       option src              lan
  79 #       option src_ip   192.168.45.2
  80 #       option src_mac  00:11:22:33:44:55
  81 #       option src_port         1024
  82 #       option src_dport        80
  83 #       option dest_ip  194.25.2.129
  84 #       option dest_port        120
  85 #       option proto    tcp