config defaults
option syn_flood 1
option input ACCEPT
- option output ACCEPT
+ option output ACCEPT
option forward REJECT
# Uncomment this line to disable ipv6 rules
# option disable_ipv6 1
config zone
option name lan
option network 'lan'
- option input ACCEPT
- option output ACCEPT
+ option input ACCEPT
+ option output ACCEPT
option forward REJECT
config zone
option name wan
option network 'wan'
option input REJECT
- option output ACCEPT
+ option output ACCEPT
option forward REJECT
- option masq 1
+ option masq 1
option mtu_fix 1
-config forwarding
- option src lan
- option dest wan
+config forwarding
+ option src lan
+ option dest wan
# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
+ option name Allow-DHCP-Renew
option src wan
option proto udp
option dest_port 68
# Allow IPv4 ping
config rule
+ option name Allow-Ping
option src wan
option proto icmp
option icmp_type echo-request
option family ipv4
option target ACCEPT
+# Allow DHCPv6 replies
+# see https://dev.openwrt.org/ticket/10381
+config rule
+ option name Allow-DHCPv6
+ option src wan
+ option proto udp
+ option src_ip fe80::/10
+ option src_port 547
+ option dest_ip fe80::/10
+ option dest_port 546
+ option family ipv6
+ option target ACCEPT
+
# Allow essential incoming IPv6 ICMP traffic
-config rule
+config rule
+ option name Allow-ICMPv6-Input
option src wan
- option dest *
- option proto icmp
- list icmp_type router-solicitation
- list icmp_type router-advertisement
- list icmp_type neighbour-solicitation
- list icmp_type neighbour-advertisement
+ option proto icmp
list icmp_type echo-request
+ list icmp_type echo-reply
list icmp_type destination-unreachable
list icmp_type packet-too-big
list icmp_type time-exceeded
+ list icmp_type bad-header
+ list icmp_type unknown-header-type
+ list icmp_type router-solicitation
+ list icmp_type neighbour-solicitation
+ list icmp_type router-advertisement
+ list icmp_type neighbour-advertisement
option limit 1000/sec
option family ipv6
option target ACCEPT
-# Drop leaking router advertisements on WAN
+# Allow essential forwarded IPv6 ICMP traffic
config rule
- option src *
- option dest wan
+ option name Allow-ICMPv6-Forward
+ option src wan
+ option dest *
option proto icmp
- option icmp_type router-advertisement
+ list icmp_type echo-request
+ list icmp_type echo-reply
+ list icmp_type destination-unreachable
+ list icmp_type packet-too-big
+ list icmp_type time-exceeded
+ list icmp_type bad-header
+ list icmp_type unknown-header-type
+ option limit 1000/sec
option family ipv6
- option target DROP
+ option target ACCEPT
# include a file with users custom iptables rules
config include
# option src_ip 192.168.45.2
# option dest wan
# option proto tcp
-# option target REJECT
+# option target REJECT
# block a specific mac on wan
#config rule
# option dest wan
# option src_mac 00:11:22:33:44:66
-# option target REJECT
+# option target REJECT
# block incoming ICMP traffic on a zone
#config rule
# option src_dport 80
# option dest lan
# option dest_ip 192.168.16.235
-# option dest_port 80
+# option dest_port 80
# option proto tcp
# port redirect of remapped ssh port (22001) on wan
# option dest_ip 194.25.2.129
# option dest_port 120
# option proto tcp
-# option target REJECT
+# option target REJECT
#config redirect
# option src lan