Skip to content

Instantly share code, notes, and snippets.

@andrenarchy
Created May 26, 2013 14:14
Show Gist options
  • Save andrenarchy/5652918 to your computer and use it in GitHub Desktop.
Save andrenarchy/5652918 to your computer and use it in GitHub Desktop.
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
option network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fe80::/10'
option src_port '547'
option dest_ip 'fe80::/10'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config zone
option masq '1'
option input 'ACCEPT'
option name 'freifunk'
option output 'ACCEPT'
list masq_src '255.255.255.255/32'
list masq_src '192.168.65.1/24'
option network 'fflan tunl0 wireless0 wireless0dhcp'
option forward 'REJECT'
config rule
option proto 'icmp'
option target 'ACCEPT'
option src 'freifunk'
config rule
option dest_port '80'
option proto 'tcp'
option target 'ACCEPT'
option src 'freifunk'
config rule
option dest_port '443'
option proto 'tcp'
option target 'ACCEPT'
option src 'freifunk'
config rule
option dest_port '22'
option proto 'tcp'
option target 'ACCEPT'
option src 'freifunk'
config rule
option dest_port '698'
option proto 'udp'
option target 'ACCEPT'
option src 'freifunk'
config rule
option dest_port '17990'
option proto 'tcp'
option target 'ACCEPT'
option src 'freifunk'
config rule
option dest_port '53'
option src 'freifunk'
option target 'ACCEPT'
option proto 'udp'
config rule
option src_port '68'
option src 'freifunk'
option target 'ACCEPT'
option dest_port '67'
option proto 'udp'
config rule
option dest_port '8082'
option src 'freifunk'
option target 'ACCEPT'
option proto 'tcp'
config include
option path '/etc/firewall.freifunk'
config advanced
option tcp_westwood '1'
option tcp_ecn '0'
option ip_conntrack_max '8192'
config zone
option masq '1'
option network 'wan'
option input 'REJECT'
option forward 'REJECT'
option name 'wan'
option output 'ACCEPT'
option local_restrict '1'
config forwarding
option dest 'wan'
option src 'lan'
config forwarding
option dest 'freifunk'
option src 'lan'
config zone
option input 'ACCEPT'
option forward 'REJECT'
option output 'ACCEPT'
option name 'vpn03'
option masq '1'
option network 'vpn03'
config forwarding
option dest 'vpn03'
option src 'freifunk'
config forwarding
option dest 'vpn03'
option src 'lan'
config rule
option name 'Reject-VPN-over-ff'
option dest 'freifunk'
option dest_ip '77.87.48.10'
option dest_port '1194'
option family 'ipv4'
option target 'REJECT'
option proto 'udp'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment