View difference between Paste ID: r4u62P0B and VWuQ7vLN

 #!/bin/sh
 GUEST_NET="192.168.2.0/24" # <-- must match guest ip network
 GUEST_IF="br1" # <-- must match guest network interface (br1, wl0.1, etc.)
 
-STATE_NEW="-m state --state NEW"
+WAN_IF="$(ip route | awk '/^default/{print $NF}')"
-REJECT="REJECT --reject-with icmp-host-prohibited"
+
-REJECT_TCP="REJECT --reject-with tcp-reset"
+
 PORT_DNS="53"
-# limit guests to essential router services (icmp echo/reply, dhcp, dns)
+
-iptables -I INPUT         -i br1 $STATE_NEW -j $REJECT
+# limit guests to essential router services (icmp, dns, dhcp)
-iptables -I INPUT -p tcp  -i br1 $STATE_NEW -j $REJECT_TCP
+iptables -I INPUT -i $GUEST_IF -j REJECT
-iptables -I INPUT -p icmp -i br1 -j ACCEPT
+iptables -I INPUT -p icmp -i $GUEST_IF -j ACCEPT
-iptables -I INPUT -p tcp  -i br1 --dport $PORT_DNS -j ACCEPT
+iptables -I INPUT -p udp  -i $GUEST_IF --dport $PORT_DHCP -j ACCEPT
-iptables -I INPUT -p udp  -i br1 --dport $PORT_DNS -j ACCEPT
+iptables -I INPUT -p tcp  -i $GUEST_IF --dport $PORT_DNS  -j ACCEPT
-iptables -I INPUT -p udp  -i br1 --dport $PORT_DHCP -j ACCEPT
+iptables -I INPUT -p udp  -i $GUEST_IF --dport $PORT_DNS  -j ACCEPT
 
 # deny access to private network by guests (internet only)
-iptables -I FORWARD        -i br1 -o br0 $STATE_NEW -j $REJECT
+iptables -I FORWARD -i $GUEST_IF -o br0 -m state --state NEW -j REJECT
-iptables -I FORWARD -p tcp -i br1 -o br0 $STATE_NEW -j $REJECT_TCP
+
 # allow access to printer on private network (optional, just an example)
 iptables -I FORWARD -i $GUEST_IF -o br0 -p tcp -d 192.168.1.100 --dport 9100 \
-iptables -I FORWARD        -i br0 -o br1 $STATE_NEW -j $REJECT
+    -m state --state NEW -j ACCEPT
-iptables -I FORWARD -p tcp -i br0 -o br1 $STATE_NEW -j $REJECT_TCP
+
 # deny access to guests by private network (optional)
 iptables -I FORWARD -i br0 -o $GUEST_IF -m state --state NEW -j REJECT
 
 # nat guest network over WAN (internet)
 iptables -t nat -I POSTROUTING -s $GUEST_NET -o $WAN_IF -j MASQUERADE