API tools faq
paste
Guest User

Untitled

a guest
Dec 21st, 2013
150
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 2.84 KB | None | 0 0
raw download clone embed print report
  1. config defaults
  2. option syn_flood 1
  3. option input ACCEPT
  4. option output ACCEPT
  5. option forward REJECT
  6. # Uncomment this line to disable ipv6 rules
  7. # option disable_ipv6 1
  8. config zone
  9. option name lan
  10. option network 'lan'
  11. option input ACCEPT
  12. option output ACCEPT
  13. option forward REJECT
  14. config zone
  15. option name wan
  16. option network 'wan vpn'
  17. option input REJECT
  18. option output ACCEPT
  19. option forward REJECT
  20. option masq 1
  21. option mtu_fix 1
  22. config forwarding
  23. option src lan
  24. option dest wan
  25. # We need to accept udp packets on port 68,
  26. # see https://dev.openwrt.org/ticket/4108
  27. config rule
  28. option name Allow-DHCP-Renew
  29. option src wan
  30. option proto udp
  31. option dest_port 68
  32. option target ACCEPT
  33. option family ipv4
  34. # Allow IPv4 ping
  35. config rule
  36. option name Allow-Ping
  37. option src wan
  38. option proto icmp
  39. option icmp_type echo-request
  40. option family ipv4
  41. option target ACCEPT
  42. # Allow DHCPv6 replies
  43. # see https://dev.openwrt.org/ticket/10381
  44. config rule
  45. option name Allow-DHCPv6
  46. option src wan
  47. option proto udp
  48. option src_ip fe80::/10
  49. option src_port 547
  50. option dest_ip fe80::/10
  51. option dest_port 546
  52. option family ipv6
  53. option target ACCEPT
  54. # Allow essential incoming IPv6 ICMP traffic
  55. config rule
  56. option name Allow-ICMPv6-Input
  57. option src wan
  58. option proto icmp
  59. list icmp_type echo-request
  60. list icmp_type echo-reply
  61. list icmp_type destination-unreachable
  62. list icmp_type packet-too-big
  63. list icmp_type time-exceeded
  64. list icmp_type bad-header
  65. list icmp_type unknown-header-type
  66. list icmp_type router-solicitation
  67. list icmp_type neighbour-solicitation
  68. list icmp_type router-advertisement
  69. list icmp_type neighbour-advertisement
  70. option limit 1000/sec
  71. option family ipv6
  72. option target ACCEPT
  73. # Allow essential forwarded IPv6 ICMP traffic
  74. config rule
  75. option name Allow-ICMPv6-Forward
  76. option src wan
  77. option dest *
  78. option proto icmp
  79. list icmp_type echo-request
  80. list icmp_type echo-reply
  81. list icmp_type destination-unreachable
  82. list icmp_type packet-too-big
  83. list icmp_type time-exceeded
  84. list icmp_type bad-header
  85. list icmp_type unknown-header-type
  86. option limit 1000/sec
  87. option family ipv6
  88. option target ACCEPT
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!