firewall: Allow IGMP and MLD input on WAN
[openwrt/staging/chunkeey.git] / package / network / config / firewall / files / firewall.config
1 config defaults
2 option syn_flood 1
3 option input ACCEPT
4 option output ACCEPT
5 option forward REJECT
6 # Uncomment this line to disable ipv6 rules
7 # option disable_ipv6 1
8
9 config zone
10 option name lan
11 list network 'lan'
12 option input ACCEPT
13 option output ACCEPT
14 option forward ACCEPT
15
16 config zone
17 option name wan
18 list network 'wan'
19 list network 'wan6'
20 option input REJECT
21 option output ACCEPT
22 option forward REJECT
23 option masq 1
24 option mtu_fix 1
25
26 config forwarding
27 option src lan
28 option dest wan
29
30 # We need to accept udp packets on port 68,
31 # see https://dev.openwrt.org/ticket/4108
32 config rule
33 option name Allow-DHCP-Renew
34 option src wan
35 option proto udp
36 option dest_port 68
37 option target ACCEPT
38 option family ipv4
39
40 # Allow IPv4 ping
41 config rule
42 option name Allow-Ping
43 option src wan
44 option proto icmp
45 option icmp_type echo-request
46 option family ipv4
47 option target ACCEPT
48
49 config rule
50 option name Allow-IGMP
51 option src wan
52 option proto igmp
53 option family ipv4
54 option target ACCEPT
55
56 # Allow DHCPv6 replies
57 # see https://dev.openwrt.org/ticket/10381
58 config rule
59 option name Allow-DHCPv6
60 option src wan
61 option proto udp
62 option src_ip fe80::/10
63 option src_port 547
64 option dest_ip fe80::/10
65 option dest_port 546
66 option family ipv6
67 option target ACCEPT
68
69 config rule
70 option name Allow-MLD
71 option src wan
72 option proto icmp
73 option src_ip fe80::/10
74 list icmp_type '130/0'
75 list icmp_type '131/0'
76 list icmp_type '132/0'
77 list icmp_type '143/0'
78 option family ipv6
79 option target ACCEPT
80
81 # Allow essential incoming IPv6 ICMP traffic
82 config rule
83 option name Allow-ICMPv6-Input
84 option src wan
85 option proto icmp
86 list icmp_type echo-request
87 list icmp_type echo-reply
88 list icmp_type destination-unreachable
89 list icmp_type packet-too-big
90 list icmp_type time-exceeded
91 list icmp_type bad-header
92 list icmp_type unknown-header-type
93 list icmp_type router-solicitation
94 list icmp_type neighbour-solicitation
95 list icmp_type router-advertisement
96 list icmp_type neighbour-advertisement
97 option limit 1000/sec
98 option family ipv6
99 option target ACCEPT
100
101 # Allow essential forwarded IPv6 ICMP traffic
102 config rule
103 option name Allow-ICMPv6-Forward
104 option src wan
105 option dest *
106 option proto icmp
107 list icmp_type echo-request
108 list icmp_type echo-reply
109 list icmp_type destination-unreachable
110 list icmp_type packet-too-big
111 list icmp_type time-exceeded
112 list icmp_type bad-header
113 list icmp_type unknown-header-type
114 option limit 1000/sec
115 option family ipv6
116 option target ACCEPT
117
118 # include a file with users custom iptables rules
119 config include
120 option path /etc/firewall.user
121
122
123 ### EXAMPLE CONFIG SECTIONS
124 # do not allow a specific ip to access wan
125 #config rule
126 # option src lan
127 # option src_ip 192.168.45.2
128 # option dest wan
129 # option proto tcp
130 # option target REJECT
131
132 # block a specific mac on wan
133 #config rule
134 # option dest wan
135 # option src_mac 00:11:22:33:44:66
136 # option target REJECT
137
138 # block incoming ICMP traffic on a zone
139 #config rule
140 # option src lan
141 # option proto ICMP
142 # option target DROP
143
144 # port redirect port coming in on wan to lan
145 #config redirect
146 # option src wan
147 # option src_dport 80
148 # option dest lan
149 # option dest_ip 192.168.16.235
150 # option dest_port 80
151 # option proto tcp
152
153 # port redirect of remapped ssh port (22001) on wan
154 #config redirect
155 # option src wan
156 # option src_dport 22001
157 # option dest lan
158 # option dest_port 22
159 # option proto tcp
160
161 # allow IPsec/ESP and ISAKMP passthrough
162 #config rule
163 # option src wan
164 # option dest lan
165 # option protocol esp
166 # option target ACCEPT
167
168 #config rule
169 # option src wan
170 # option dest lan
171 # option src_port 500
172 # option dest_port 500
173 # option proto udp
174 # option target ACCEPT
175
176 ### FULL CONFIG SECTIONS
177 #config rule
178 # option src lan
179 # option src_ip 192.168.45.2
180 # option src_mac 00:11:22:33:44:55
181 # option src_port 80
182 # option dest wan
183 # option dest_ip 194.25.2.129
184 # option dest_port 120
185 # option proto tcp
186 # option target REJECT
187
188 #config redirect
189 # option src lan
190 # option src_ip 192.168.45.2
191 # option src_mac 00:11:22:33:44:55
192 # option src_port 1024
193 # option src_dport 80
194 # option dest_ip 194.25.2.129
195 # option dest_port 120
196 # option proto tcp