API tools faq
paste
Advertisement
AndiTails

/etc/config/firewall

AndiTails
Feb 26th, 2014
320
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 2.56 KB | None | 0 0
raw download clone embed print report
  1.  
  2. config defaults
  3. option syn_flood '1'
  4. option input 'ACCEPT'
  5. option output 'ACCEPT'
  6. option forward 'REJECT'
  7.  
  8. config zone
  9. option name 'lan'
  10. option input 'ACCEPT'
  11. option output 'ACCEPT'
  12. option forward 'REJECT'
  13. option network 'lan'
  14.  
  15. config zone
  16. option name 'wan'
  17. option input 'REJECT'
  18. option output 'ACCEPT'
  19. option forward 'REJECT'
  20. option masq '1'
  21. option mtu_fix '1'
  22. option network 'wan VPN'
  23.  
  24. config rule
  25. option name 'Allow-DHCP-Renew'
  26. option src 'wan'
  27. option proto 'udp'
  28. option dest_port '68'
  29. option target 'ACCEPT'
  30. option family 'ipv4'
  31.  
  32. config rule
  33. option name 'Allow-Ping'
  34. option src 'wan'
  35. option proto 'icmp'
  36. option icmp_type 'echo-request'
  37. option family 'ipv4'
  38. option target 'ACCEPT'
  39.  
  40. config rule
  41. option name 'Allow-DHCPv6'
  42. option src 'wan'
  43. option proto 'udp'
  44. option src_ip 'fe80::/10'
  45. option src_port '547'
  46. option dest_ip 'fe80::/10'
  47. option dest_port '546'
  48. option family 'ipv6'
  49. option target 'ACCEPT'
  50.  
  51. config rule
  52. option name 'Allow-ICMPv6-Input'
  53. option src 'wan'
  54. option proto 'icmp'
  55. list icmp_type 'echo-request'
  56. list icmp_type 'echo-reply'
  57. list icmp_type 'destination-unreachable'
  58. list icmp_type 'packet-too-big'
  59. list icmp_type 'time-exceeded'
  60. list icmp_type 'bad-header'
  61. list icmp_type 'unknown-header-type'
  62. list icmp_type 'router-solicitation'
  63. list icmp_type 'neighbour-solicitation'
  64. list icmp_type 'router-advertisement'
  65. list icmp_type 'neighbour-advertisement'
  66. option limit '1000/sec'
  67. option family 'ipv6'
  68. option target 'ACCEPT'
  69.  
  70. config rule
  71. option name 'Allow-ICMPv6-Forward'
  72. option src 'wan'
  73. option dest '*'
  74. option proto 'icmp'
  75. list icmp_type 'echo-request'
  76. list icmp_type 'echo-reply'
  77. list icmp_type 'destination-unreachable'
  78. list icmp_type 'packet-too-big'
  79. list icmp_type 'time-exceeded'
  80. list icmp_type 'bad-header'
  81. list icmp_type 'unknown-header-type'
  82. option limit '1000/sec'
  83. option family 'ipv6'
  84. option target 'ACCEPT'
  85.  
  86. config include
  87. option path '/etc/firewall.user'
  88.  
  89. config rule
  90. option target 'ACCEPT'
  91. option src 'wan'
  92. option proto 'tcp'
  93. option dest_port '22'
  94. option name 'SSH'
  95.  
  96. config forwarding
  97. option dest 'wan'
  98. option src 'lan'
  99.  
  100. config rule
  101. option src 'lan'
  102. option name 'Samba'
  103. option src_port '445'
  104. option dest_port '445'
  105. option target 'NOTRACK'
  106.  
  107. config zone
  108. option output 'ACCEPT'
  109. option name 'vpn'
  110. option masq '1'
  111. option input 'ACCEPT'
  112. option forward 'REJECT'
  113. option network 'vpn'
  114.  
  115. config forwarding
  116. option dest 'lan'
  117. option src 'vpn'
  118.  
  119. config forwarding
  120. option dest 'vpn'
  121. option src 'lan'
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!