mr/openwrt
2
0
Fork 1
Code Issues 7 Pull Requests Releases Wiki Activity
e106f25ee7
openwrt/package/network/config/firewall/files/firewall.config

196 lines
4.1 KiB
Plaintext
Raw Normal View History

adds a new uci firewall - iptbales and netfilter packages need to be rewrapped when we switch to this firewall as default - there are some examples in the file /etc/config/firewall - iptables-save/restore are still missing - hotplug takes care of adding/removing netdevs during runtime - misisng features ? wishes ? let me know ... SVN-Revision: 12089
2008-08-04 19:51:58 +08:00
config defaults
option syn_flood 1
set default input policy to ACCEPT to bring the firewall behavior closer to the one of previous versions SVN-Revision: 12766
2008-09-29 00:17:49 +08:00
option input ACCEPT
minor change: adjust formatting of firewall.config - remove trailing whitespaces (s/\ $//g) - replace spaces with tabs between options and values SVN-Revision: 31427
2012-04-22 03:42:28 +08:00
option output ACCEPT
firewall changes: - implement a REJECT policy and enable it by default, reject packets with approriate response (closes: #3970) - cleanup syn_flood and remove logging SVN-Revision: 12688
2008-09-24 23:10:16 +08:00
option forward REJECT
firewall: add commented disable_ipv6 option to default config SVN-Revision: 21505
2010-05-19 17:49:21 +08:00
# Uncomment this line to disable ipv6 rules
# option disable_ipv6 1
adds a new uci firewall - iptbales and netfilter packages need to be rewrapped when we switch to this firewall as default - there are some examples in the file /etc/config/firewall - iptables-save/restore are still missing - hotplug takes care of adding/removing netdevs during runtime - misisng features ? wishes ? let me know ... SVN-Revision: 12089
2008-08-04 19:51:58 +08:00
config zone
option name lan
firewall: - allow multiple ports, protocols, macs, icmp types per rule - implement "limit" and "limit_burst" options for rules - implement "extra" option to rules and redirects for passing arbritary flags to iptables - implement negations for "src_port", "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options - allow wildcard (*) "src" and "dest" options in rules to allow specifying "any" source or destination - validate symbolic icmp-type names against the selected iptables binary - properly handle forwarded ICMPv6 traffic in the default configuration SVN-Revision: 27317
2011-06-30 09:31:23 +08:00
option network 'lan'
minor change: adjust formatting of firewall.config - remove trailing whitespaces (s/\ $//g) - replace spaces with tabs between options and values SVN-Revision: 31427
2012-04-22 03:42:28 +08:00
option input ACCEPT
option output ACCEPT
firewall: - allow multiple ports, protocols, macs, icmp types per rule - implement "limit" and "limit_burst" options for rules - implement "extra" option to rules and redirects for passing arbritary flags to iptables - implement negations for "src_port", "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options - allow wildcard (*) "src" and "dest" options in rules to allow specifying "any" source or destination - validate symbolic icmp-type names against the selected iptables binary - properly handle forwarded ICMPv6 traffic in the default configuration SVN-Revision: 27317
2011-06-30 09:31:23 +08:00
option forward REJECT
adds a new uci firewall - iptbales and netfilter packages need to be rewrapped when we switch to this firewall as default - there are some examples in the file /etc/config/firewall - iptables-save/restore are still missing - hotplug takes care of adding/removing netdevs during runtime - misisng features ? wishes ? let me know ... SVN-Revision: 12089
2008-08-04 19:51:58 +08:00
config zone
option name wan
firewall: - allow multiple ports, protocols, macs, icmp types per rule - implement "limit" and "limit_burst" options for rules - implement "extra" option to rules and redirects for passing arbritary flags to iptables - implement negations for "src_port", "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options - allow wildcard (*) "src" and "dest" options in rules to allow specifying "any" source or destination - validate symbolic icmp-type names against the selected iptables binary - properly handle forwarded ICMPv6 traffic in the default configuration SVN-Revision: 27317
2011-06-30 09:31:23 +08:00
option network 'wan'
option input REJECT
minor change: adjust formatting of firewall.config - remove trailing whitespaces (s/\ $//g) - replace spaces with tabs between options and values SVN-Revision: 31427
2012-04-22 03:42:28 +08:00
option output ACCEPT
firewall: - allow multiple ports, protocols, macs, icmp types per rule - implement "limit" and "limit_burst" options for rules - implement "extra" option to rules and redirects for passing arbritary flags to iptables - implement negations for "src_port", "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options - allow wildcard (*) "src" and "dest" options in rules to allow specifying "any" source or destination - validate symbolic icmp-type names against the selected iptables binary - properly handle forwarded ICMPv6 traffic in the default configuration SVN-Revision: 27317
2011-06-30 09:31:23 +08:00
option forward REJECT
minor change: adjust formatting of firewall.config - remove trailing whitespaces (s/\ $//g) - replace spaces with tabs between options and values SVN-Revision: 31427
2012-04-22 03:42:28 +08:00
option masq 1
firewall: - allow multiple ports, protocols, macs, icmp types per rule - implement "limit" and "limit_burst" options for rules - implement "extra" option to rules and redirects for passing arbritary flags to iptables - implement negations for "src_port", "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options - allow wildcard (*) "src" and "dest" options in rules to allow specifying "any" source or destination - validate symbolic icmp-type names against the selected iptables binary - properly handle forwarded ICMPv6 traffic in the default configuration SVN-Revision: 27317
2011-06-30 09:31:23 +08:00
option mtu_fix 1
adds a new uci firewall - iptbales and netfilter packages need to be rewrapped when we switch to this firewall as default - there are some examples in the file /etc/config/firewall - iptables-save/restore are still missing - hotplug takes care of adding/removing netdevs during runtime - misisng features ? wishes ? let me know ... SVN-Revision: 12089
2008-08-04 19:51:58 +08:00
minor change: adjust formatting of firewall.config - remove trailing whitespaces (s/\ $//g) - replace spaces with tabs between options and values SVN-Revision: 31427
2012-04-22 03:42:28 +08:00
config forwarding
option src lan
option dest wan
disable the MSS fixup hack by default (most ISPs don't require this as a workaround for MTU problems, only some do). this should give a nice speedup for routing on standard-compliant ISPs SVN-Revision: 13788
2009-01-01 03:02:03 +08:00
firewall: allow incoming udp/68 packets in the default configuration (#4108, #4781) SVN-Revision: 17238
2009-08-13 11:31:53 +08:00
# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
firewall: - introduce per-section "option enabled" which defaults to "1" - useful to disable rules or zones without having to delete them - annotate default traffic rules with names - bump version SVN-Revision: 29577
2011-12-20 09:10:15 +08:00
option name Allow-DHCP-Renew
firewall: allow incoming udp/68 packets in the default configuration (#4108, #4781) SVN-Revision: 17238
2009-08-13 11:31:53 +08:00
option src wan
option proto udp
option dest_port 68
option target ACCEPT
firewall: - allow multiple ports, protocols, macs, icmp types per rule - implement "limit" and "limit_burst" options for rules - implement "extra" option to rules and redirects for passing arbritary flags to iptables - implement negations for "src_port", "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options - allow wildcard (*) "src" and "dest" options in rules to allow specifying "any" source or destination - validate symbolic icmp-type names against the selected iptables binary - properly handle forwarded ICMPv6 traffic in the default configuration SVN-Revision: 27317
2011-06-30 09:31:23 +08:00
option family ipv4
# Allow IPv4 ping
config rule
firewall: - introduce per-section "option enabled" which defaults to "1" - useful to disable rules or zones without having to delete them - annotate default traffic rules with names - bump version SVN-Revision: 29577
2011-12-20 09:10:15 +08:00
option name Allow-Ping
firewall: - allow multiple ports, protocols, macs, icmp types per rule - implement "limit" and "limit_burst" options for rules - implement "extra" option to rules and redirects for passing arbritary flags to iptables - implement negations for "src_port", "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options - allow wildcard (*) "src" and "dest" options in rules to allow specifying "any" source or destination - validate symbolic icmp-type names against the selected iptables binary - properly handle forwarded ICMPv6 traffic in the default configuration SVN-Revision: 27317
2011-06-30 09:31:23 +08:00
option src wan
option proto icmp
option icmp_type echo-request
option family ipv4
option target ACCEPT
firewall: add DHCPv6 default rule (#10381) SVN-Revision: 28874
2011-11-09 19:10:37 +08:00
# Allow DHCPv6 replies
# see https://dev.openwrt.org/ticket/10381
config rule
firewall: - introduce per-section "option enabled" which defaults to "1" - useful to disable rules or zones without having to delete them - annotate default traffic rules with names - bump version SVN-Revision: 29577
2011-12-20 09:10:15 +08:00
option name Allow-DHCPv6
firewall: add DHCPv6 default rule (#10381) SVN-Revision: 28874
2011-11-09 19:10:37 +08:00
option src wan
option proto udp
option src_ip fe80::/10
option src_port 547
option dest_ip fe80::/10
option dest_port 546
option family ipv6
option target ACCEPT
firewall: - allow multiple ports, protocols, macs, icmp types per rule - implement "limit" and "limit_burst" options for rules - implement "extra" option to rules and redirects for passing arbritary flags to iptables - implement negations for "src_port", "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options - allow wildcard (*) "src" and "dest" options in rules to allow specifying "any" source or destination - validate symbolic icmp-type names against the selected iptables binary - properly handle forwarded ICMPv6 traffic in the default configuration SVN-Revision: 27317
2011-06-30 09:31:23 +08:00
# Allow essential incoming IPv6 ICMP traffic
firewall: further tune ICMPv6 default rules according to RFC4890 (#9893) SVN-Revision: 27979
2011-08-14 08:33:29 +08:00
config rule
firewall: - introduce per-section "option enabled" which defaults to "1" - useful to disable rules or zones without having to delete them - annotate default traffic rules with names - bump version SVN-Revision: 29577
2011-12-20 09:10:15 +08:00
option name Allow-ICMPv6-Input
firewall: further tune ICMPv6 default rules according to RFC4890 (#9893) SVN-Revision: 27979
2011-08-14 08:33:29 +08:00
option src wan
option proto icmp
list icmp_type echo-request
firewall: allow ICMPv6 type 129 (echo reply) - this fixes basic ICMPv6 in case no connection tracking is used SVN-Revision: 30727
2012-02-26 05:00:23 +08:00
list icmp_type echo-reply
firewall: further tune ICMPv6 default rules according to RFC4890 (#9893) SVN-Revision: 27979
2011-08-14 08:33:29 +08:00
list icmp_type destination-unreachable
list icmp_type packet-too-big
list icmp_type time-exceeded
list icmp_type bad-header
list icmp_type unknown-header-type
list icmp_type router-solicitation
list icmp_type neighbour-solicitation
firewall: allow incoming ICMPv6 router-advertisement and neighbor-advertisement, thanks swalker SVN-Revision: 32127
2012-06-08 22:20:34 +08:00
list icmp_type router-advertisement
list icmp_type neighbour-advertisement
firewall: further tune ICMPv6 default rules according to RFC4890 (#9893) SVN-Revision: 27979
2011-08-14 08:33:29 +08:00
option limit 1000/sec
option family ipv6
option target ACCEPT
# Allow essential forwarded IPv6 ICMP traffic
minor change: adjust formatting of firewall.config - remove trailing whitespaces (s/\ $//g) - replace spaces with tabs between options and values SVN-Revision: 31427
2012-04-22 03:42:28 +08:00
config rule
firewall: - introduce per-section "option enabled" which defaults to "1" - useful to disable rules or zones without having to delete them - annotate default traffic rules with names - bump version SVN-Revision: 29577
2011-12-20 09:10:15 +08:00
option name Allow-ICMPv6-Forward
firewall: - allow multiple ports, protocols, macs, icmp types per rule - implement "limit" and "limit_burst" options for rules - implement "extra" option to rules and redirects for passing arbritary flags to iptables - implement negations for "src_port", "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options - allow wildcard (*) "src" and "dest" options in rules to allow specifying "any" source or destination - validate symbolic icmp-type names against the selected iptables binary - properly handle forwarded ICMPv6 traffic in the default configuration SVN-Revision: 27317
2011-06-30 09:31:23 +08:00
option src wan
option dest *
option proto icmp
list icmp_type echo-request
firewall: allow ICMPv6 type 129 (echo reply) - this fixes basic ICMPv6 in case no connection tracking is used SVN-Revision: 30727
2012-02-26 05:00:23 +08:00
list icmp_type echo-reply
firewall: - allow multiple ports, protocols, macs, icmp types per rule - implement "limit" and "limit_burst" options for rules - implement "extra" option to rules and redirects for passing arbritary flags to iptables - implement negations for "src_port", "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options - allow wildcard (*) "src" and "dest" options in rules to allow specifying "any" source or destination - validate symbolic icmp-type names against the selected iptables binary - properly handle forwarded ICMPv6 traffic in the default configuration SVN-Revision: 27317
2011-06-30 09:31:23 +08:00
list icmp_type destination-unreachable
list icmp_type packet-too-big
list icmp_type time-exceeded
firewall: refine default ICMPv6 rules to better conform with RFC4890, do not forward link local ICMP message types, allow parameter problem SVN-Revision: 27321
2011-06-30 20:22:05 +08:00
list icmp_type bad-header
list icmp_type unknown-header-type
firewall: - allow multiple ports, protocols, macs, icmp types per rule - implement "limit" and "limit_burst" options for rules - implement "extra" option to rules and redirects for passing arbritary flags to iptables - implement negations for "src_port", "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options - allow wildcard (*) "src" and "dest" options in rules to allow specifying "any" source or destination - validate symbolic icmp-type names against the selected iptables binary - properly handle forwarded ICMPv6 traffic in the default configuration SVN-Revision: 27317
2011-06-30 09:31:23 +08:00
option limit 1000/sec
option family ipv6
option target ACCEPT
firewall: allow incoming udp/68 packets in the default configuration (#4108, #4781) SVN-Revision: 17238
2009-08-13 11:31:53 +08:00
firewall: Add ULA site border for IPv6 traffic This prevents private traffic from leaking out to the internet SVN-Revision: 35012
2013-01-04 23:59:28 +08:00
# Block ULA-traffic from leaking out
config rule
option name Enforce-ULA-Border-Src
option src *
option dest wan
option proto all
option src_ip fc00::/7
option family ipv6
option target REJECT
config rule
option name Enforce-ULA-Border-Dest
option src *
option dest wan
option proto all
option dest_ip fc00::/7
option family ipv6
option target REJECT
firewall: enable /etc/firewall.user by default and install sample firewall.user file SVN-Revision: 15221
2009-04-13 06:38:34 +08:00
# include a file with users custom iptables rules
config include
option path /etc/firewall.user
adds a new uci firewall - iptbales and netfilter packages need to be rewrapped when we switch to this firewall as default - there are some examples in the file /etc/config/firewall - iptables-save/restore are still missing - hotplug takes care of adding/removing netdevs during runtime - misisng features ? wishes ? let me know ... SVN-Revision: 12089
2008-08-04 19:51:58 +08:00
### EXAMPLE CONFIG SECTIONS
# do not allow a specific ip to access wan
#config rule
# option src lan
# option src_ip 192.168.45.2
# option dest wan
# option proto tcp
minor change: adjust formatting of firewall.config - remove trailing whitespaces (s/\ $//g) - replace spaces with tabs between options and values SVN-Revision: 31427
2012-04-22 03:42:28 +08:00
# option target REJECT
adds a new uci firewall - iptbales and netfilter packages need to be rewrapped when we switch to this firewall as default - there are some examples in the file /etc/config/firewall - iptables-save/restore are still missing - hotplug takes care of adding/removing netdevs during runtime - misisng features ? wishes ? let me know ... SVN-Revision: 12089
2008-08-04 19:51:58 +08:00
# block a specific mac on wan
#config rule
# option dest wan
# option src_mac 00:11:22:33:44:66
minor change: adjust formatting of firewall.config - remove trailing whitespaces (s/\ $//g) - replace spaces with tabs between options and values SVN-Revision: 31427
2012-04-22 03:42:28 +08:00
# option target REJECT
adds a new uci firewall - iptbales and netfilter packages need to be rewrapped when we switch to this firewall as default - there are some examples in the file /etc/config/firewall - iptables-save/restore are still missing - hotplug takes care of adding/removing netdevs during runtime - misisng features ? wishes ? let me know ... SVN-Revision: 12089
2008-08-04 19:51:58 +08:00
# block incoming ICMP traffic on a zone
#config rule
# option src lan
# option proto ICMP
# option target DROP
# port redirect port coming in on wan to lan
#config redirect
# option src wan
# option src_dport 80
# option dest lan
# option dest_ip 192.168.16.235
minor change: adjust formatting of firewall.config - remove trailing whitespaces (s/\ $//g) - replace spaces with tabs between options and values SVN-Revision: 31427
2012-04-22 03:42:28 +08:00
# option dest_port 80
use proto instead of protocol in uci firewall SVN-Revision: 12391
2008-08-26 15:23:29 +08:00
# option proto tcp
adds a new uci firewall - iptbales and netfilter packages need to be rewrapped when we switch to this firewall as default - there are some examples in the file /etc/config/firewall - iptables-save/restore are still missing - hotplug takes care of adding/removing netdevs during runtime - misisng features ? wishes ? let me know ... SVN-Revision: 12089
2008-08-04 19:51:58 +08:00
firewall: provide examples of ssh port relocation on firewall and IPsec passthrough Two examples of potentially useful configurations (commented out, of course): (a) map the ssh service running on the firewall to 22001 externally, without modifying the configuration of the daemon itself. this allows port 22 on the WAN side to then be port-forwarded to a LAN-based machine if desired, or if not, simply obscures the port from external attack. (b) allow IPsec/ESP and ISAKMP (UDP-based key exchange) to happen by default. useful for most modern VPN clients you might have on your WAN. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com> SVN-Revision: 26805
2011-05-02 20:54:31 +08:00
# port redirect of remapped ssh port (22001) on wan
#config redirect
# option src wan
# option src_dport 22001
# option dest lan
# option dest_port 22
# option proto tcp
# allow IPsec/ESP and ISAKMP passthrough
#config rule
# option src wan
# option dest lan
# option protocol esp
# option target ACCEPT
#config rule
# option src wan
# option dest lan
# option src_port 500
# option dest_port 500
# option proto udp
# option target ACCEPT
adds a new uci firewall - iptbales and netfilter packages need to be rewrapped when we switch to this firewall as default - there are some examples in the file /etc/config/firewall - iptables-save/restore are still missing - hotplug takes care of adding/removing netdevs during runtime - misisng features ? wishes ? let me know ... SVN-Revision: 12089
2008-08-04 19:51:58 +08:00
### FULL CONFIG SECTIONS
#config rule
# option src lan
# option src_ip 192.168.45.2
# option src_mac 00:11:22:33:44:55
# option src_port 80
# option dest wan
# option dest_ip 194.25.2.129
# option dest_port 120
# option proto tcp
minor change: adjust formatting of firewall.config - remove trailing whitespaces (s/\ $//g) - replace spaces with tabs between options and values SVN-Revision: 31427
2012-04-22 03:42:28 +08:00
# option target REJECT
adds a new uci firewall - iptbales and netfilter packages need to be rewrapped when we switch to this firewall as default - there are some examples in the file /etc/config/firewall - iptables-save/restore are still missing - hotplug takes care of adding/removing netdevs during runtime - misisng features ? wishes ? let me know ... SVN-Revision: 12089
2008-08-04 19:51:58 +08:00
#config redirect
# option src lan
# option src_ip 192.168.45.2
# option src_mac 00:11:22:33:44:55
# option src_port 1024
# option src_dport 80
# option dest_ip 194.25.2.129
# option dest_port 120
# option proto tcp
Reference in New Issue Copy Permalink