6 # Uncomment this line to disable ipv6 rules
7 # option disable_ipv6 1
29 # We need to accept udp packets on port 68,
30 # see https://dev.openwrt.org/ticket/4108
32 option name Allow-DHCP-Renew
41 option name Allow-Ping
44 option icmp_type echo-request
48 # Allow DHCPv6 replies
49 # see https://dev.openwrt.org/ticket/10381
51 option name Allow-DHCPv6
54 option src_ip fe80::/10
56 option dest_ip fe80::/10
61 # Allow essential incoming IPv6 ICMP traffic
63 option name Allow-ICMPv6-Input
66 list icmp_type echo-request
67 list icmp_type destination-unreachable
68 list icmp_type packet-too-big
69 list icmp_type time-exceeded
70 list icmp_type bad-header
71 list icmp_type unknown-header-type
72 list icmp_type router-solicitation
73 list icmp_type neighbour-solicitation
74 list icmp_type router-advertisement
75 list icmp_type neighbour-advertisement
80 # Allow essential forwarded IPv6 ICMP traffic
82 option name Allow-ICMPv6-Forward
86 list icmp_type echo-request
87 list icmp_type destination-unreachable
88 list icmp_type packet-too-big
89 list icmp_type time-exceeded
90 list icmp_type bad-header
91 list icmp_type unknown-header-type
96 # include a file with users custom iptables rules
98 option path /etc/firewall.user
101 ### EXAMPLE CONFIG SECTIONS
102 # do not allow a specific ip to access wan
105 # option src_ip 192.168.45.2
108 # option target REJECT
110 # block a specific mac on wan
113 # option src_mac 00:11:22:33:44:66
114 # option target REJECT
116 # block incoming ICMP traffic on a zone
122 # port redirect port coming in on wan to lan
125 # option src_dport 80
127 # option dest_ip 192.168.16.235
128 # option dest_port 80
132 ### FULL CONFIG SECTIONS
135 # option src_ip 192.168.45.2
136 # option src_mac 00:11:22:33:44:55
139 # option dest_ip 194.25.2.129
140 # option dest_port 120
142 # option target REJECT
146 # option src_ip 192.168.45.2
147 # option src_mac 00:11:22:33:44:55
148 # option src_port 1024
149 # option src_dport 80
150 # option dest_ip 194.25.2.129
151 # option dest_port 120