1 #!/bin/sh /etc/rc.common
2 # Copyright (C) 2006 OpenWrt.org
4 ## Please make changes in /etc/firewall.user
10 config_get WAN wan ifname
11 config_get WANDEV wan device
12 config_get LAN lan ifname
13 config_get_bool NAT_LAN lan nat 1
16 config_get LAN_MASK lan netmask
17 config_get LAN_IP lan ipaddr
18 LAN_NET=$(/bin/ipcalc.sh $LAN_IP $LAN_MASK | grep NETWORK | cut -d= -f2)
22 for T in filter nat; do
27 iptables -N input_rule
29 iptables -N output_rule
30 iptables -N forwarding_rule
31 iptables -N forwarding_wan
33 iptables -t nat -N NEW
34 iptables -t nat -N prerouting_rule
35 iptables -t nat -N prerouting_wan
36 iptables -t nat -N postrouting_rule
38 iptables -N LAN_ACCEPT
39 [ -z "$WAN" ] || iptables -A LAN_ACCEPT -i "$WAN" -j RETURN
40 [ -z "$WANDEV" -o "$WANDEV" = "$WAN" ] || iptables -A LAN_ACCEPT -i "$WANDEV" -j RETURN
41 iptables -A LAN_ACCEPT -j ACCEPT
44 ### (connections with the router as destination)
47 iptables -P INPUT DROP
48 iptables -A INPUT -m state --state INVALID -j DROP
49 iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
50 iptables -A INPUT -p tcp --tcp-flags SYN SYN --tcp-option \! 2 -j DROP
53 # insert accept rule or to jump to new accept-check table here
55 iptables -A INPUT -j input_rule
56 [ -z "$WAN" ] || iptables -A INPUT -i $WAN -j input_wan
59 iptables -A INPUT -j LAN_ACCEPT # allow from lan/wifi interfaces
60 iptables -A INPUT -p icmp -j ACCEPT # allow ICMP
61 iptables -A INPUT -p gre -j ACCEPT # allow GRE
63 # reject (what to do with anything not allowed earlier)
64 iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
65 iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
68 ### (connections with the router as source)
71 iptables -P OUTPUT DROP
72 iptables -A OUTPUT -m state --state INVALID -j DROP
73 iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
76 # insert accept rule or to jump to new accept-check table here
78 iptables -A OUTPUT -j output_rule
81 iptables -A OUTPUT -j ACCEPT #allow everything out
83 # reject (what to do with anything not allowed earlier)
84 iptables -A OUTPUT -p tcp -j REJECT --reject-with tcp-reset
85 iptables -A OUTPUT -j REJECT --reject-with icmp-port-unreachable
88 ### (connections routed through the router)
91 iptables -P FORWARD DROP
92 iptables -A FORWARD -m state --state INVALID -j DROP
93 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
94 iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
97 # insert accept rule or to jump to new accept-check table here
99 iptables -A FORWARD -j forwarding_rule
100 [ -z "$WAN" ] || iptables -A FORWARD -i $WAN -j forwarding_wan
103 iptables -A FORWARD -i $LAN -o $LAN -j ACCEPT
104 [ -z "$WAN" ] || iptables -A FORWARD -i $LAN -o $WAN -j ACCEPT
106 # reject (what to do with anything not allowed earlier)
107 # uses the default -P DROP
110 iptables -t nat -A PREROUTING -m state --state NEW -p tcp -j NEW
111 iptables -t nat -A PREROUTING -j prerouting_rule
112 [ -z "$WAN" ] || iptables -t nat -A PREROUTING -i "$WAN" -j prerouting_wan
113 iptables -t nat -A POSTROUTING -j postrouting_rule
114 ### Only LAN, unless told not to
115 if [ $NAT_LAN -ne 0 ]
117 [ -z "$WAN" ] || iptables -t nat -A POSTROUTING --src $LAN_NET/$LAN_MASK -o $WAN -j MASQUERADE
120 iptables -t nat -A NEW -m limit --limit 50 --limit-burst 100 -j RETURN && \
121 iptables -t nat -A NEW -j DROP
124 [ -f /etc/firewall.user ] && . /etc/firewall.user
125 [ -n "$WAN" -a -e /etc/firewall.config ] && {
127 awk -f /usr/lib/common.awk -f /usr/lib/firewall.awk /etc/firewall.config | ash
132 iptables -P INPUT ACCEPT
133 iptables -P OUTPUT ACCEPT
134 iptables -P FORWARD ACCEPT
137 iptables -t nat -P PREROUTING ACCEPT
138 iptables -t nat -P POSTROUTING ACCEPT
139 iptables -t nat -P OUTPUT ACCEPT