作者: volospin 時間: 2014-2-17 16:25 標題: Long time no iptables
Failed to config OpenWRT iptables to enable access from WAN to LuCi or SSH.
作者: ronstudio 時間: 2014-2-17 16:56
as a practise of iptables, is the following useful?
1) list out current iptables config
iptables -L
2) clear all outstanding rules and reset all INPUT and FORWARD default chain to DROP
iptables -t filter -F
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
3) Block invalid packages and allow the passage of established/related stage package
iptables -t filter -A INPUT -p tcp -m state --state INVALID -j DROP
iptables -t filter -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
4) Now adding the new access port for SSH.
iptables -A FORWARD -i ethx -o ethx -m state --state INVALID -j DROP
iptables -A FORWARD -i ethx -o ethx -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i ethx -o ethx -p tcp --dport 22 -j ACCEPT
5) Verify if the rule has been added and save it
iptables -L
service iptables save
Remember to change the ethx to eth0, eth1, eth2 depends on your configuration in step4.
作者: volospin 時間: 2014-2-19 12:40
root@Xenon:/etc/config# cat firewall
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
option network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'wan wwan'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fe80::/10'
option src_port '547'
option dest_ip 'fe80::/10'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'