# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
+ option name Allow-DHCP-Renew
option src wan
option proto udp
option dest_port 68
# Allow IPv4 ping
config rule
+ option name Allow-Ping
option src wan
option proto icmp
option icmp_type echo-request
# Allow DHCPv6 replies
# see https://dev.openwrt.org/ticket/10381
config rule
+ option name Allow-DHCPv6
option src wan
option proto udp
option src_ip fe80::/10
# Allow essential incoming IPv6 ICMP traffic
config rule
+ option name Allow-ICMPv6-Input
option src wan
option proto icmp
list icmp_type echo-request
list icmp_type unknown-header-type
list icmp_type router-solicitation
list icmp_type neighbour-solicitation
+ list icmp_type router-advertisement
+ list icmp_type neighbour-advertisement
option limit 1000/sec
option family ipv6
option target ACCEPT
# Allow essential forwarded IPv6 ICMP traffic
config rule
+ option name Allow-ICMPv6-Forward
option src wan
option dest *
option proto icmp