firewall

config defaults
	option syn_flood '1'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'lan'
	option network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fe80::/10'
	option src_port '547'
	option dest_ip 'fe80::/10'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config include
	option path '/etc/firewall.user'

config zone
	option masq '1'
	option input 'ACCEPT'
	option name 'freifunk'
	option output 'ACCEPT'
	list masq_src '255.255.255.255/32'
	list masq_src '192.168.65.1/24'
	option network 'fflan tunl0 wireless0 wireless0dhcp'
	option forward 'REJECT'

config rule
	option proto 'icmp'
	option target 'ACCEPT'
	option src 'freifunk'

config rule
	option dest_port '80'
	option proto 'tcp'
	option target 'ACCEPT'
	option src 'freifunk'

config rule
	option dest_port '443'
	option proto 'tcp'
	option target 'ACCEPT'
	option src 'freifunk'

config rule
	option dest_port '22'
	option proto 'tcp'
	option target 'ACCEPT'
	option src 'freifunk'

config rule
	option dest_port '698'
	option proto 'udp'
	option target 'ACCEPT'
	option src 'freifunk'

config rule
	option dest_port '17990'
	option proto 'tcp'
	option target 'ACCEPT'
	option src 'freifunk'

config rule
	option dest_port '53'
	option src 'freifunk'
	option target 'ACCEPT'
	option proto 'udp'

config rule
	option src_port '68'
	option src 'freifunk'
	option target 'ACCEPT'
	option dest_port '67'
	option proto 'udp'

config rule
	option dest_port '8082'
	option src 'freifunk'
	option target 'ACCEPT'
	option proto 'tcp'

config include
	option path '/etc/firewall.freifunk'

config advanced
	option tcp_westwood '1'
	option tcp_ecn '0'
	option ip_conntrack_max '8192'

config zone
	option masq '1'
	option network 'wan'
	option input 'REJECT'
	option forward 'REJECT'
	option name 'wan'
	option output 'ACCEPT'
	option local_restrict '1'

config forwarding
	option dest 'wan'
	option src 'lan'

config forwarding
	option dest 'freifunk'
	option src 'lan'



config zone
	option input 'ACCEPT'
	option forward 'REJECT'
	option output 'ACCEPT'
	option name 'vpn03'
	option masq '1'
	option network 'vpn03'

config forwarding
	option dest 'vpn03'
	option src 'freifunk'

config forwarding
	option dest 'vpn03'
	option src 'lan'

config rule
	option name 'Reject-VPN-over-ff'
	option dest 'freifunk'
	option dest_ip '77.87.48.10'
	option dest_port '1194'
	option family 'ipv4'
	option target 'REJECT'
	option proto 'udp'