root@OpenWrt:~# cat /etc/config/firewall
config defaults
    option syn_flood    1
    option input        ACCEPT
    option output       ACCEPT
    option forward      REJECT
# Uncomment this line to disable ipv6 rules
#   option disable_ipv6 1

config zone
    option name     lan
    option network      'lan'
    option input        ACCEPT
    option output       ACCEPT
    option forward      REJECT

config zone
    option name     wan
    option network      'wan vpn'
    option input        REJECT
    option output       ACCEPT
    option forward      REJECT
    option masq     1
    option mtu_fix      1

config forwarding
    option src          lan
    option dest         wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
    option name     Allow-DHCP-Renew
    option src      wan
    option proto        udp
    option dest_port    68
    option target       ACCEPT
    option family       ipv4

# Allow IPv4 ping
config rule
    option name     Allow-Ping
    option src      wan
    option proto        icmp
    option icmp_type    echo-request
    option family       ipv4
    option target       ACCEPT

# Allow DHCPv6 replies
# see https://dev.openwrt.org/ticket/10381
config rule
    option name     Allow-DHCPv6
    option src      wan
    option proto        udp
    option src_ip       fe80::/10
    option src_port     547
    option dest_ip      fe80::/10
    option dest_port    546
    option family       ipv6
    option target       ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
    option name     Allow-ICMPv6-Input
    option src      wan
    option proto    icmp
    list icmp_type      echo-request
    list icmp_type      destination-unreachable
    list icmp_type      packet-too-big
    list icmp_type      time-exceeded
    list icmp_type      bad-header
    list icmp_type      unknown-header-type
    list icmp_type      router-solicitation
    list icmp_type      neighbour-solicitation
    list icmp_type      router-advertisement
    list icmp_type      neighbour-advertisement
    option limit        1000/sec
    option family       ipv6
    option target       ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
    option name     Allow-ICMPv6-Forward
    option src      wan
    option dest     *
    option proto        icmp
    list icmp_type      echo-request
    list icmp_type      destination-unreachable
    list icmp_type      packet-too-big
    list icmp_type      time-exceeded
    list icmp_type      bad-header
    list icmp_type      unknown-header-type
    option limit        1000/sec
    option family       ipv6
    option target       ACCEPT

# include a file with users custom iptables rules
config include
    option path /etc/firewall.user


### EXAMPLE CONFIG SECTIONS
# do not allow a specific ip to access wan
#config rule
#   option src      lan
#   option src_ip   192.168.45.2
#   option dest     wan
#   option proto    tcp
#   option target   REJECT

# block a specific mac on wan
#config rule
#   option dest     wan
#   option src_mac  00:11:22:33:44:66
#   option target   REJECT

# block incoming ICMP traffic on a zone
#config rule
#   option src      lan
#   option proto    ICMP
#   option target   DROP

# port redirect port coming in on wan to lan
#config redirect
#   option src          wan
#   option src_dport    80
#   option dest         lan
#   option dest_ip      192.168.16.235
#   option dest_port    80
#   option proto        tcp

config redirect
    option src  wan
    option src_dport    80
    option dest lan
    option dest_ip  192.168.1.131
    option dest_port    80
    option proto    tcpudp

config redirect
    option src  wan
    option src_dport    443
    option dest     lan
    option dest_ip      192.168.1.131
    option dest_port    443
    option proto        tcpudp

config redirect
    option src  wan
    option src_dport    5555
    option dest_ip  192.168.1.131
    option dest_port 22
    option dest     lan
    option target   DNAT
    option proto tcp
### FULL CONFIG SECTIONS
#config rule
#   option src      lan
#   option src_ip   192.168.45.2
#   option src_mac  00:11:22:33:44:55
#   option src_port 80
#   option dest     wan
#   option dest_ip  194.25.2.129
#   option dest_port    120
#   option proto    tcp
#   option target   REJECT

#config redirect
#   option src      lan
#   option src_ip   192.168.45.2
#   option src_mac  00:11:22:33:44:55
#   option src_port     1024
#   option src_dport    80
#   option dest_ip  194.25.2.129
#   option dest_port    120
#   option proto    tcp