API tools faq
paste
Advertisement
nnsense

firewall

nnsense
Apr 21st, 2018
119
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 4.38 KB | None | 0 0
raw download clone embed print report
  1. config defaults
  2.         option syn_flood '1'
  3.         option input 'ACCEPT'
  4.         option output 'ACCEPT'
  5.         option forward 'REJECT'
  6.         option disabled '0'
  7.  
  8. config zone
  9.         option name 'lan'
  10.         list network 'lan'
  11.         option input 'ACCEPT'
  12.         option output 'ACCEPT'
  13.         option forward 'ACCEPT'
  14.         option masq '1'
  15.  
  16. config zone
  17.         option name 'wan'
  18.         list network 'wan'
  19.         list network 'wan6'
  20.         option input 'REJECT'
  21.         option output 'ACCEPT'
  22.         option forward 'REJECT'
  23.         option masq '1'
  24.         option mtu_fix '1'
  25.  
  26. config rule
  27.         option name 'Allow-DHCP-Renew'
  28.         option src 'wan'
  29.         option proto 'udp'
  30.         option dest_port '68'
  31.         option target 'ACCEPT'
  32.         option family 'ipv4'
  33.  
  34. config rule
  35.         option name 'Allow-Ping'
  36.         option src 'wan'
  37.         option proto 'icmp'
  38.         option icmp_type 'echo-request'
  39.         option family 'ipv4'
  40.         option target 'ACCEPT'
  41.  
  42. config rule
  43.         option name 'Allow-IGMP'
  44.         option src 'wan'
  45.         option proto 'igmp'
  46.         option family 'ipv4'
  47.         option target 'ACCEPT'
  48.  
  49. config rule
  50.         option name 'Allow-DHCPv6'
  51.         option src 'wan'
  52.         option proto 'udp'
  53.         option src_ip 'fe80::/10'
  54.         option src_port '547'
  55.         option dest_ip 'fe80::/10'
  56.         option dest_port '546'
  57.         option family 'ipv6'
  58.         option target 'ACCEPT'
  59.  
  60. config rule
  61.         option name 'Allow-MLD'
  62.         option src 'wan'
  63.         option proto 'icmp'
  64.         option src_ip 'fe80::/10'
  65.         list icmp_type '130/0'
  66.         list icmp_type '131/0'
  67.         list icmp_type '132/0'
  68.         list icmp_type '143/0'
  69.         option family 'ipv6'
  70.         option target 'ACCEPT'
  71.  
  72. config rule
  73.         option name 'Allow-ICMPv6-Input'
  74.         option src 'wan'
  75.         option proto 'icmp'
  76.         list icmp_type 'echo-request'
  77.         list icmp_type 'echo-reply'
  78.         list icmp_type 'destination-unreachable'
  79.         list icmp_type 'packet-too-big'
  80.         list icmp_type 'time-exceeded'
  81.         list icmp_type 'bad-header'
  82.         list icmp_type 'unknown-header-type'
  83.         list icmp_type 'router-solicitation'
  84.         list icmp_type 'neighbour-solicitation'
  85.         list icmp_type 'router-advertisement'
  86.         list icmp_type 'neighbour-advertisement'
  87.         option limit '1000/sec'
  88.         option family 'ipv6'
  89.         option target 'ACCEPT'
  90.  
  91. config rule
  92.         option name 'Allow-ICMPv6-Forward'
  93.         option src 'wan'
  94.         option dest '*'
  95.         option proto 'icmp'
  96.         list icmp_type 'echo-request'
  97.         list icmp_type 'echo-reply'
  98.         list icmp_type 'destination-unreachable'
  99.         list icmp_type 'packet-too-big'
  100.         list icmp_type 'time-exceeded'
  101.         list icmp_type 'bad-header'
  102.         list icmp_type 'unknown-header-type'
  103.         option limit '1000/sec'
  104.         option family 'ipv6'
  105.         option target 'ACCEPT'
  106.  
  107. config include
  108.         option path '/etc/firewall.user'
  109.  
  110. config rule
  111.         option src 'wan'
  112.         option dest 'lan'
  113.         option proto 'esp'
  114.         option target 'ACCEPT'
  115.  
  116. config rule
  117.         option src 'wan'
  118.         option dest 'lan'
  119.         option dest_port '500'
  120.         option proto 'udp'
  121.         option target 'ACCEPT'
  122.  
  123. config include 'miniupnpd'
  124.         option type 'script'
  125.         option path '/usr/share/miniupnpd/firewall.include'
  126.         option family 'any'
  127.         option reload '1'
  128.  
  129. config include 'qcanssecm'
  130.         option type 'script'
  131.         option path '/etc/firewall.d/qca-nss-ecm'
  132.         option family 'any'
  133.         option reload '0'
  134.  
  135. config include 'shadowsocks'
  136.         option type 'script'
  137.         option path '/var/etc/shadowsocks.include'
  138.         option reload '1'
  139.  
  140. config rule 'glservice_rule'
  141.         option name 'glservice'
  142.         option dest_port '83'
  143.         option proto 'tcp udp'
  144.         option src 'wan'
  145.         option target 'ACCEPT'
  146.         option enabled '0'
  147.  
  148. config forwarding 'forwarding_origin'
  149.         option src 'lan'
  150.         option dest 'wan'
  151.  
  152. config zone 'vpn_zone'
  153.         option name 'VPN_client'
  154.         option input 'ACCEPT'
  155.         option forward 'REJECT'
  156.         option output 'ACCEPT'
  157.         option network 'VPN_client'
  158.         option masq '1'
  159.  
  160. config forwarding 'forwarding_vpn1'
  161.         option dest 'VPN_client'
  162.         option src 'lan'
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!