X-Git-Url: http://git.ozo.com/?p=openwrt-10.03%2F.git;a=blobdiff_plain;f=package%2Ffirewall%2Ffiles%2Ffirewall.config;fp=package%2Ffirewall%2Ffiles%2Ffirewall.config;h=7904cedb879140804a8afa1f7f76258538a05516;hp=0000000000000000000000000000000000000000;hb=fe72fdb0222ffa56be4fc263e476126e95ccd77c;hpb=67a112aafe5ad132848e559330017d2eeea3c536

diff --git a/package/firewall/files/firewall.config b/package/firewall/files/firewall.config
new file mode 100644
index 000000000..7904cedb8
--- /dev/null
+++ b/package/firewall/files/firewall.config
@@ -0,0 +1,99 @@
+config defaults
+	option syn_flood	1
+	option input		ACCEPT
+	option output		ACCEPT 
+	option forward		REJECT
+# Uncomment this line to disable ipv6 rules
+#	option disable_ipv6	1
+
+config zone
+	option name		lan
+	option input	ACCEPT 
+	option output	ACCEPT 
+	option forward	REJECT
+
+config zone
+	option name		wan
+	option input	REJECT
+	option output	ACCEPT 
+	option forward	REJECT
+	option masq		1 
+	option mtu_fix	1
+
+config forwarding 
+	option src      lan
+	option dest     wan
+
+# We need to accept udp packets on port 68,
+# see https://dev.openwrt.org/ticket/4108
+config rule
+	option src		wan
+	option proto		udp
+	option dest_port	68
+	option target		ACCEPT
+	option family	ipv4
+
+#Allow ping
+config rule
+	option src wan
+	option proto icmp
+	option icmp_type echo-request
+	option target ACCEPT
+
+# include a file with users custom iptables rules
+config include
+	option path /etc/firewall.user
+
+
+### EXAMPLE CONFIG SECTIONS
+# do not allow a specific ip to access wan
+#config rule
+#	option src		lan
+#	option src_ip	192.168.45.2
+#	option dest		wan
+#	option proto	tcp
+#	option target	REJECT 
+
+# block a specific mac on wan
+#config rule
+#	option dest		wan
+#	option src_mac	00:11:22:33:44:66
+#	option target	REJECT 
+
+# block incoming ICMP traffic on a zone
+#config rule
+#	option src		lan
+#	option proto	ICMP
+#	option target	DROP
+
+# port redirect port coming in on wan to lan
+#config redirect
+#	option src			wan
+#	option src_dport	80
+#	option dest			lan
+#	option dest_ip		192.168.16.235
+#	option dest_port	80 
+#	option proto		tcp
+
+
+### FULL CONFIG SECTIONS
+#config rule
+#	option src		lan
+#	option src_ip	192.168.45.2
+#	option src_mac	00:11:22:33:44:55
+#	option src_port	80
+#	option dest		wan
+#	option dest_ip	194.25.2.129
+#	option dest_port	120
+#	option proto	tcp
+#	option target	REJECT 
+
+#config redirect
+#	option src		lan
+#	option src_ip	192.168.45.2
+#	option src_mac	00:11:22:33:44:55
+#	option src_port		1024
+#	option src_dport	80
+#	option dest_ip	194.25.2.129
+#	option dest_port	120
+#	option proto	tcp