Skip to content

Instantly share code, notes, and snippets.

@txomon

txomon/etc_config_firewall

Last active November 8, 2015 12:30
Show Gist options
  • Save txomon/e1976f5ded32d1894d01 to your computer and use it in GitHub Desktop.
Save txomon/e1976f5ded32d1894d01 to your computer and use it in GitHub Desktop.
Download ZIP
Trying to sort this out :(
Raw
etc_config_firewall
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option network 'lan'
config zone
option output 'ACCEPT'
option name 'nat'
option input 'ACCEPT'
option forward 'REJECT'
option network 'flat wwan'
option masq '1'
option mtu_fix '1'
config rule
option name 'Allow-DHCP-Renew'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
option src 'nat'
config rule
option name 'Allow-Ping'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
option src 'nat'
config rule
option name 'Allow-IGMP'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
option src 'nat'
config rule
option name 'Allow-DHCPv6'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
option src 'nat'
config rule
option name 'Allow-MLD'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
option src 'nat'
config rule
option name 'Allow-ICMPv6-Input'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
option src 'nat'
config rule
option name 'Allow-ICMPv6-Forward'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
option src 'nat'
config include
option path '/etc/firewall.user'
config rule
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
option src 'nat'
config rule
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
option src 'nat'
config zone
option name 'relay'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option network 'relay'
config zone
option input 'ACCEPT'
option output 'ACCEPT'
option name 'wan'
option forward 'ACCEPT'
option network 'wan'
config forwarding
option dest 'relay'
option src 'nat'
config forwarding
option dest 'wan'
option src 'nat'
config forwarding
option dest 'nat'
option src 'wan'
config forwarding
option dest 'relay'
option src 'wan'
config forwarding
option dest 'nat'
option src 'relay'
config forwarding
option dest 'wan'
option src 'relay'
config forwarding
option dest 'nat'
option src 'lan'
config forwarding
option dest 'relay'
option src 'lan'
config forwarding
option dest 'wan'
option src 'lan'
config zone
option name 'personal'
option input 'ACCEPT'
option forward 'REJECT'
option output 'ACCEPT'
option network 'personal'
config forwarding
option dest 'nat'
option src 'personal'
config forwarding
option dest 'relay'
option src 'personal'
config forwarding
option dest 'wan'
option src 'personal'
config forwarding
option dest 'personal'
option src 'nat'
config forwarding
option dest 'personal'
option src 'relay'
config forwarding
option dest 'personal'
option src 'wan'
Raw
etc_config_network
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd25:ac70:210e::/48'
config interface 'lan'
option ifname 'eth0.1'
option force_link '1'
option macaddr '00:18:84:89:42:5c'
option type 'bridge'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
config switch
option name 'rt305x'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'rt305x'
option vlan '1'
option ports '0 1 2 3 5 6t'
config switch_vlan
option device 'rt305x'
option vlan '2'
option ports '4 6t'
config interface 'flat'
option proto 'dhcp'
option ifname 'wlan0'
config interface 'relay'
option proto 'relay'
list network 'flat'
list network 'personal'
list network 'wan'
config interface 'wan'
option proto 'none'
option ifname 'eth0.2'
config interface 'personal'
option proto 'none'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment