Created
May 26, 2013 13:08
-
-
Save booo/5652737 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
config defaults | |
option syn_flood '1' | |
option input 'ACCEPT' | |
option output 'ACCEPT' | |
option forward 'REJECT' | |
option drop_invalid '0' | |
config zone | |
option name 'lan' | |
option network 'lan' | |
option input 'ACCEPT' | |
option output 'ACCEPT' | |
option forward 'REJECT' | |
config rule | |
option name 'Allow-DHCP-Renew' | |
option src 'vpn' | |
option proto 'udp' | |
option dest_port '68' | |
option target 'ACCEPT' | |
option family 'ipv4' | |
config rule | |
option name 'Allow-Ping' | |
option src 'vpn' | |
option proto 'icmp' | |
option icmp_type 'echo-request' | |
option family 'ipv4' | |
option target 'ACCEPT' | |
config rule | |
option name 'Allow-DHCPv6' | |
option src 'vpn' | |
option proto 'udp' | |
option src_ip 'fe80::/10' | |
option src_port '547' | |
option dest_ip 'fe80::/10' | |
option dest_port '546' | |
option family 'ipv6' | |
option target 'ACCEPT' | |
config rule | |
option name 'Allow-ICMPv6-Input' | |
option src 'vpn' | |
option proto 'icmp' | |
list icmp_type 'echo-request' | |
list icmp_type 'echo-reply' | |
list icmp_type 'destination-unreachable' | |
list icmp_type 'packet-too-big' | |
list icmp_type 'time-exceeded' | |
list icmp_type 'bad-header' | |
list icmp_type 'unknown-header-type' | |
list icmp_type 'router-solicitation' | |
list icmp_type 'neighbour-solicitation' | |
list icmp_type 'router-advertisement' | |
list icmp_type 'neighbour-advertisement' | |
option limit '1000/sec' | |
option family 'ipv6' | |
option target 'ACCEPT' | |
config rule | |
option name 'Allow-ICMPv6-Forward' | |
option src 'vpn' | |
option dest '*' | |
option proto 'icmp' | |
list icmp_type 'echo-request' | |
list icmp_type 'echo-reply' | |
list icmp_type 'destination-unreachable' | |
list icmp_type 'packet-too-big' | |
list icmp_type 'time-exceeded' | |
list icmp_type 'bad-header' | |
list icmp_type 'unknown-header-type' | |
option limit '1000/sec' | |
option family 'ipv6' | |
option target 'ACCEPT' | |
config include | |
option path '/etc/firewall.user' | |
config include | |
option path '/etc/firewall.freifunk' | |
config advanced | |
option tcp_westwood '1' | |
option tcp_ecn '0' | |
option ip_conntrack_max '8192' | |
config zone | |
option masq '1' | |
option input 'ACCEPT' | |
option forward 'REJECT' | |
option name 'freifunk' | |
option output 'ACCEPT' | |
option network 'tunl0 wireless0 wireless0dhcp' | |
list masq_src '255.255.255.255/32' | |
list masq_src '192.168.42.1/24' | |
config forwarding | |
option dest 'freifunk' | |
option src 'lan' | |
config forwarding | |
option dest 'freifunk' | |
option src 'freifunk' | |
config rule | |
option proto 'icmp' | |
option target 'ACCEPT' | |
option src 'freifunk' | |
config rule | |
option dest_port '80' | |
option proto 'tcp' | |
option target 'ACCEPT' | |
option src 'freifunk' | |
config rule | |
option dest_port '443' | |
option proto 'tcp' | |
option target 'ACCEPT' | |
option src 'freifunk' | |
config rule | |
option dest_port '22' | |
option proto 'tcp' | |
option target 'ACCEPT' | |
option src 'freifunk' | |
config rule | |
option dest_port '698' | |
option proto 'udp' | |
option target 'ACCEPT' | |
option src 'freifunk' | |
config rule | |
option dest_port '17990' | |
option proto 'tcp' | |
option target 'ACCEPT' | |
option src 'freifunk' | |
config rule | |
option dest_port '53' | |
option src 'freifunk' | |
option target 'ACCEPT' | |
option proto 'udp' | |
config rule | |
option src_port '68' | |
option src 'freifunk' | |
option target 'ACCEPT' | |
option dest_port '67' | |
option proto 'udp' | |
config rule | |
option dest_port '8082' | |
option src 'freifunk' | |
option target 'ACCEPT' | |
option proto 'tcp' | |
config zone | |
option masq '1' | |
option network 'vpn' | |
option input 'REJECT' | |
option forward 'REJECT' | |
option name 'vpn' | |
option output 'ACCEPT' | |
option local_restrict '1' | |
config forwarding | |
option dest 'vpn' | |
option src 'freifunk' | |
config forwarding | |
option dest 'freifunk' | |
option src 'vpn' | |
config forwarding | |
option dest 'vpn' | |
option src 'lan' |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment