3 ## Please make changes in /etc/firewall.user
10 for T
in filter nat
; do
15 iptables
-N input_rule
16 iptables
-N output_rule
17 iptables
-N forwarding_rule
19 iptables
-t nat
-N prerouting_rule
20 iptables
-t nat
-N postrouting_rule
23 ### (connections with the router as destination)
26 iptables
-P INPUT DROP
27 iptables
-A INPUT
-m state
--state INVALID
-j DROP
28 iptables
-A INPUT
-m state
--state RELATED
,ESTABLISHED
-j ACCEPT
29 iptables
-A INPUT
-p tcp
--tcp-flags SYN SYN
--tcp-option \
! 2 -j DROP
32 # insert accept rule or to jump to new accept-check table here
34 iptables
-A INPUT
-j input_rule
37 [ -z "$WAN" ] || iptables
-A INPUT
-i \
! $WAN -j ACCEPT
# allow from lan/wifi interfaces
38 iptables
-A INPUT
-p icmp
-j ACCEPT
# allow ICMP
39 iptables
-A INPUT
-p gre
-j ACCEPT
# allow GRE
41 # reject (what to do with anything not allowed earlier)
42 iptables
-A INPUT
-p tcp
-j REJECT
--reject-with tcp-reset
43 iptables
-A INPUT
-j REJECT
--reject-with icmp-port-unreachable
46 ### (connections with the router as source)
49 iptables
-P OUTPUT DROP
50 iptables
-A OUTPUT
-m state
--state INVALID
-j DROP
51 iptables
-A OUTPUT
-m state
--state RELATED
,ESTABLISHED
-j ACCEPT
54 # insert accept rule or to jump to new accept-check table here
56 iptables
-A OUTPUT
-j output_rule
59 iptables
-A OUTPUT
-j ACCEPT
#allow everything out
61 # reject (what to do with anything not allowed earlier)
62 iptables
-A OUTPUT
-p tcp
-j REJECT
--reject-with tcp-reset
63 iptables
-A OUTPUT
-j REJECT
--reject-with icmp-port-unreachable
66 ### (connections routed through the router)
69 iptables
-P FORWARD DROP
70 iptables
-A FORWARD
-m state
--state INVALID
-j DROP
71 iptables
-A FORWARD
-p tcp
--tcp-flags SYN
,RST SYN
-j TCPMSS
--clamp-mss-to-pmtu
72 iptables
-A FORWARD
-m state
--state RELATED
,ESTABLISHED
-j ACCEPT
75 # insert accept rule or to jump to new accept-check table here
77 iptables
-A FORWARD
-j forwarding_rule
80 iptables
-A FORWARD
-i br0
-o br0
-j ACCEPT
81 [ -z "$WAN" ] || iptables
-A FORWARD
-i $LAN -o $WAN -j ACCEPT
83 # reject (what to do with anything not allowed earlier)
84 # uses the default -P DROP
87 iptables
-t nat
-A PREROUTING
-j prerouting_rule
88 iptables
-t nat
-A POSTROUTING
-j postrouting_rule
89 [ -z "$WAN" ] || iptables
-t nat
-A POSTROUTING
-o $WAN -j MASQUERADE
92 [ -f /etc
/firewall.user
] && .
/etc
/firewall.user
93 [ -n "$WAN" -a -e /etc
/config
/firewall
] && {
94 awk -f /usr
/lib
/common.
awk -f /usr
/lib
/firewall.
awk /etc
/config
/firewall | ash
This page took 0.069774 seconds and 5 git commands to generate.