summaryrefslogtreecommitdiffstats
path: root/minikrebs/profiles/rickroller/customfiles/etc/config/firewall
diff options
context:
space:
mode:
authormakefu <github@syntax-fehler.de>2013-01-07 11:58:28 +0700
committermakefu <github@syntax-fehler.de>2013-01-07 11:59:29 +0700
commit6ea50f3c77350e715649aa45061beb1701ebaa95 (patch)
tree44e6b5927ab32c9417d755d5ecc1f7ee876d9d1f /minikrebs/profiles/rickroller/customfiles/etc/config/firewall
parentd907a7aa781caac2a3086535f5ce997131170ca2 (diff)
rickroller: initial commit
Diffstat (limited to 'minikrebs/profiles/rickroller/customfiles/etc/config/firewall')
-rw-r--r--minikrebs/profiles/rickroller/customfiles/etc/config/firewall110
1 files changed, 110 insertions, 0 deletions
diff --git a/minikrebs/profiles/rickroller/customfiles/etc/config/firewall b/minikrebs/profiles/rickroller/customfiles/etc/config/firewall
new file mode 100644
index 00000000..6e95b5cd
--- /dev/null
+++ b/minikrebs/profiles/rickroller/customfiles/etc/config/firewall
@@ -0,0 +1,110 @@
+config defaults
+ option syn_flood 1
+ option input ACCEPT
+ option output ACCEPT
+ option forward REJECT
+
+config zone
+ option name lan
+ option network 'lan'
+ option input ACCEPT
+ option output ACCEPT
+ option forward REJECT
+
+config zone
+ option name wan
+ option network 'wan'
+ option input ACCEPT
+ option output ACCEPT
+ option forward REJECT
+ option masq 1
+ option mtu_fix 1
+
+config forwarding
+ option src lan
+ option dest wan
+
+# We need to accept udp packets on port 68,
+# see https://dev.openwrt.org/ticket/4108
+config rule
+ option name Allow-DHCP-Renew
+ option src wan
+ option proto udp
+ option dest_port 68
+ option target ACCEPT
+ option family ipv4
+
+# Allow IPv4 ping
+config rule
+ option name Allow-Ping
+ option src wan
+ option proto icmp
+ option icmp_type echo-request
+ option family ipv4
+ option target ACCEPT
+
+# Allow DHCPv6 replies
+# see https://dev.openwrt.org/ticket/10381
+config rule
+ option name Allow-DHCPv6
+ option src wan
+ option proto udp
+ option src_ip fe80::/10
+ option src_port 547
+ option dest_ip fe80::/10
+ option dest_port 546
+ option family ipv6
+ option target ACCEPT
+
+# Allow essential incoming IPv6 ICMP traffic
+config rule
+ option name Allow-ICMPv6-Input
+ option src wan
+ option proto icmp
+ list icmp_type echo-request
+ list icmp_type echo-reply
+ list icmp_type destination-unreachable
+ list icmp_type packet-too-big
+ list icmp_type time-exceeded
+ list icmp_type bad-header
+ list icmp_type unknown-header-type
+ list icmp_type router-solicitation
+ list icmp_type neighbour-solicitation
+ list icmp_type router-advertisement
+ list icmp_type neighbour-advertisement
+ option limit 1000/sec
+ option family ipv6
+ option target ACCEPT
+
+# Allow essential forwarded IPv6 ICMP traffic
+config rule
+ option name Allow-ICMPv6-Forward
+ option src wan
+ option dest *
+ option proto icmp
+ list icmp_type echo-request
+ list icmp_type echo-reply
+ list icmp_type destination-unreachable
+ list icmp_type packet-too-big
+ list icmp_type time-exceeded
+ list icmp_type bad-header
+ list icmp_type unknown-header-type
+ option limit 1000/sec
+ option family ipv6
+ option target ACCEPT
+
+# does not seem to work for some reason:
+#config redirect
+# option src lan
+# option proto tcp
+# option src_dport 80
+# option dest_port 80
+
+config redirect
+ option src lan
+ option proto tcp
+ option src_dport 80
+ option src_ip !192.168.23.1
+ option dest_port 80
+ option dest_ip 192.168.23.1
+ option target DNAT