Advertisement
Guest User

Firewall

a guest
Jan 5th, 2017
339
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 3.67 KB | None | 0 0
  1.  
  2. config defaults
  3. option syn_flood '1'
  4. option input 'ACCEPT'
  5. option output 'ACCEPT'
  6. option forward 'REJECT'
  7.  
  8. config zone
  9. option name 'lan'
  10. option network 'lan'
  11. option input 'ACCEPT'
  12. option output 'ACCEPT'
  13. option forward 'ACCEPT'
  14.  
  15. config zone
  16. option name 'wan'
  17. option network 'wan'
  18. option input 'REJECT'
  19. option output 'ACCEPT'
  20. option forward 'REJECT'
  21. option masq '1'
  22. option mtu_fix '1'
  23.  
  24. config zone
  25. option name 'iptv'
  26. option network 'iptv'
  27. option input 'ACCEPT'
  28. option forward 'REJECT'
  29. option output 'ACCEPT'
  30. option masq '1'
  31.  
  32. config forwarding
  33. option dest 'wan'
  34. option src 'lan'
  35.  
  36. config forwarding
  37. option dest 'lan'
  38. option src 'iptv'
  39.  
  40. config forwarding
  41. option dest 'iptv'
  42. option src 'lan'
  43.  
  44. config rule
  45. option name 'Allow-DHCP-Renew'
  46. option src 'wan'
  47. option proto 'udp'
  48. option dest_port '68'
  49. option target 'ACCEPT'
  50. option family 'ipv4'
  51.  
  52. config rule
  53. option name 'Allow-Ping'
  54. option src 'wan'
  55. option proto 'icmp'
  56. option icmp_type 'echo-request'
  57. option family 'ipv4'
  58. option target 'ACCEPT'
  59.  
  60. config rule
  61. option name 'Allow-IGMP'
  62. option src 'wan'
  63. option proto 'igmp'
  64. option family 'ipv4'
  65. option target 'ACCEPT'
  66.  
  67. config rule
  68. option name 'Allow-IGMP'
  69. option src 'iptv'
  70. option proto 'igmp'
  71. option family 'ipv4'
  72. option target 'ACCEPT'
  73.  
  74. config rule
  75. option name 'Allow-IGMP-Proxy'
  76. option proto 'udp'
  77. option family 'ipv4'
  78. option target 'ACCEPT'
  79. option dest_ip '224.0.0.0/4'
  80. option dest 'lan'
  81. option src 'iptv'
  82.  
  83. config rule
  84. option name 'Allow-DHCPv6'
  85. option src 'wan'
  86. option proto 'udp'
  87. option src_ip 'fe80::/10'
  88. option src_port '547'
  89. option dest_ip 'fe80::/10'
  90. option dest_port '546'
  91. option family 'ipv6'
  92. option target 'ACCEPT'
  93.  
  94. config rule
  95. option name 'Allow-MLD'
  96. option src 'wan'
  97. option proto 'icmp'
  98. option src_ip 'fe80::/10'
  99. list icmp_type '130/0'
  100. list icmp_type '131/0'
  101. list icmp_type '132/0'
  102. list icmp_type '143/0'
  103. option family 'ipv6'
  104. option target 'ACCEPT'
  105.  
  106. config rule
  107. option name 'Allow-ICMPv6-Input'
  108. option src 'wan'
  109. option proto 'icmp'
  110. list icmp_type 'echo-request'
  111. list icmp_type 'echo-reply'
  112. list icmp_type 'destination-unreachable'
  113. list icmp_type 'packet-too-big'
  114. list icmp_type 'time-exceeded'
  115. list icmp_type 'bad-header'
  116. list icmp_type 'unknown-header-type'
  117. list icmp_type 'router-solicitation'
  118. list icmp_type 'neighbour-solicitation'
  119. list icmp_type 'router-advertisement'
  120. list icmp_type 'neighbour-advertisement'
  121. option limit '1000/sec'
  122. option family 'ipv6'
  123. option target 'ACCEPT'
  124.  
  125. config rule
  126. option name 'Allow-ICMPv6-Forward'
  127. option src 'wan'
  128. option dest '*'
  129. option proto 'icmp'
  130. list icmp_type 'echo-request'
  131. list icmp_type 'echo-reply'
  132. list icmp_type 'destination-unreachable'
  133. list icmp_type 'packet-too-big'
  134. list icmp_type 'time-exceeded'
  135. list icmp_type 'bad-header'
  136. list icmp_type 'unknown-header-type'
  137. option limit '1000/sec'
  138. option family 'ipv6'
  139. option target 'ACCEPT'
  140.  
  141. config rule
  142. option src 'wan'
  143. option dest 'lan'
  144. option proto 'esp'
  145. option target 'ACCEPT'
  146.  
  147. config rule
  148. option src 'wan'
  149. option dest 'lan'
  150. option dest_port '500'
  151. option proto 'udp'
  152. option target 'ACCEPT'
  153.  
  154. config include
  155. option path '/etc/firewall.user'
  156.  
  157. config include
  158. option path '/usr/share/firewall/turris'
  159. option reload '1'
  160.  
  161. config include
  162. option path '/etc/firewall.d/with_reload/firewall.include.sh'
  163. option reload '1'
  164.  
  165. config include
  166. option path '/etc/firewall.d/without_reload/firewall.include.sh'
  167. option reload '0'
  168.  
  169. config include 'miniupnpd'
  170. option type 'script'
  171. option path '/usr/share/miniupnpd/firewall.include'
  172. option family 'any'
  173. option reload '1'
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement