API tools faq
paste
Guest User

/etc/config/firewall

a guest
Mar 1st, 2018
100
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
autoconf 2.98 KB | None | 0 0
raw download clone embed print report
  1. cat /etc/config/firewall
  2.  
  3. config defaults
  4.     option syn_flood '1'
  5.     option input 'ACCEPT'
  6.     option output 'ACCEPT'
  7.     option forward 'REJECT'
  8.  
  9. config zone
  10.     option name 'lan'
  11.     option input 'ACCEPT'
  12.     option output 'ACCEPT'
  13.     option network 'lan'
  14.     option forward 'ACCEPT'
  15.  
  16. config zone
  17.     option name 'wan'
  18.     option input 'REJECT'
  19.     option output 'ACCEPT'
  20.     option forward 'REJECT'
  21.     option masq '1'
  22.     option mtu_fix '1'
  23.     option network 'wan wan6'
  24.  
  25. config rule
  26.     option name 'Allow-DHCP-Renew'
  27.     option src 'wan'
  28.     option proto 'udp'
  29.     option dest_port '68'
  30.     option target 'ACCEPT'
  31.     option family 'ipv4'
  32.  
  33. config rule
  34.     option name 'Allow-Ping'
  35.     option src 'wan'
  36.     option proto 'icmp'
  37.     option icmp_type 'echo-request'
  38.     option family 'ipv4'
  39.     option target 'ACCEPT'
  40.  
  41. config rule
  42.     option name 'Allow-IGMP'
  43.     option src 'wan'
  44.     option proto 'igmp'
  45.     option family 'ipv4'
  46.     option target 'ACCEPT'
  47.  
  48. config rule
  49.     option name 'Allow-DHCPv6'
  50.     option src 'wan'
  51.     option proto 'udp'
  52.     option src_ip 'fc00::/6'
  53.     option dest_ip 'fc00::/6'
  54.     option dest_port '546'
  55.     option family 'ipv6'
  56.     option target 'ACCEPT'
  57.  
  58. config rule
  59.     option name 'Allow-MLD'
  60.     option src 'wan'
  61.     option proto 'icmp'
  62.     option src_ip 'fe80::/10'
  63.     list icmp_type '130/0'
  64.     list icmp_type '131/0'
  65.     list icmp_type '132/0'
  66.     list icmp_type '143/0'
  67.     option family 'ipv6'
  68.     option target 'ACCEPT'
  69.  
  70. config rule
  71.     option name 'Allow-ICMPv6-Input'
  72.     option src 'wan'
  73.     option proto 'icmp'
  74.     list icmp_type 'echo-request'
  75.     list icmp_type 'echo-reply'
  76.     list icmp_type 'destination-unreachable'
  77.     list icmp_type 'packet-too-big'
  78.     list icmp_type 'time-exceeded'
  79.     list icmp_type 'bad-header'
  80.     list icmp_type 'unknown-header-type'
  81.     list icmp_type 'router-solicitation'
  82.     list icmp_type 'neighbour-solicitation'
  83.     list icmp_type 'router-advertisement'
  84.     list icmp_type 'neighbour-advertisement'
  85.     option limit '1000/sec'
  86.     option family 'ipv6'
  87.     option target 'ACCEPT'
  88.  
  89. config rule
  90.     option name 'Allow-ICMPv6-Forward'
  91.     option src 'wan'
  92.     option dest '*'
  93.     option proto 'icmp'
  94.     list icmp_type 'echo-request'
  95.     list icmp_type 'echo-reply'
  96.     list icmp_type 'destination-unreachable'
  97.     list icmp_type 'packet-too-big'
  98.     list icmp_type 'time-exceeded'
  99.     list icmp_type 'bad-header'
  100.     list icmp_type 'unknown-header-type'
  101.     option limit '1000/sec'
  102.     option family 'ipv6'
  103.     option target 'ACCEPT'
  104.  
  105. config rule
  106.     option name 'Allow-IPSec-ESP'
  107.     option src 'wan'
  108.     option dest 'lan'
  109.     option proto 'esp'
  110.     option target 'ACCEPT'
  111.  
  112. config rule
  113.     option name 'Allow-ISAKMP'
  114.     option src 'wan'
  115.     option dest 'lan'
  116.     option dest_port '500'
  117.     option proto 'udp'
  118.     option target 'ACCEPT'
  119.  
  120. config include
  121.     # /etc/firewall.user is empty
  122.     option path '/etc/firewall.user'
  123.  
  124. config zone
  125.     option name 'wan2'
  126.     option forward 'REJECT'
  127.     option output 'ACCEPT'
  128.     option masq '1'
  129.     option mtu_fix '1'
  130.     option input 'REJECT'
  131.     option network 'WAN2 wan2'
  132.  
  133. config forwarding
  134.     option dest 'wan'
  135.     option src 'lan'
  136.  
  137. config forwarding
  138.     option dest 'wan2'
  139.     option src 'lan'
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!