Buffalo WZR-HP-G300NH LEDE/OpenWRT network and firewall configuration for Telia.lt
Based on this configuration.
Tested on lede-17.01.4-ar71xx-generic-wzr-hp-g300nh-squashfs-sysupgrade.bin
image.
- IPTV
- IPTV
- LAN/Internet
- LAN/Internet
config defaults | |
option syn_flood 1 | |
option input ACCEPT | |
option output ACCEPT | |
option forward REJECT | |
# Uncomment this line to disable ipv6 rules | |
# option disable_ipv6 1 | |
config zone | |
option name lan | |
list network 'lan' | |
option input ACCEPT | |
option output ACCEPT | |
option forward ACCEPT | |
config zone | |
option name wan | |
list network 'wan' | |
list network 'wan6' | |
option input REJECT | |
option output ACCEPT | |
option forward REJECT | |
option masq 1 | |
option mtu_fix 1 | |
config zone | |
option name 'iptv' | |
option forward 'REJECT' | |
option output 'ACCEPT' | |
option network 'iptv' | |
option input 'REJECT' | |
option masq '1' | |
option mtu_fix '1' | |
config forwarding | |
option src lan | |
option dest wan | |
config forwarding | |
option dest 'iptv' | |
option src 'lan' | |
# We need to accept udp packets on port 68, | |
# see https://dev.openwrt.org/ticket/4108 | |
config rule | |
option name Allow-DHCP-Renew | |
option src wan | |
option proto udp | |
option dest_port 68 | |
option target ACCEPT | |
option family ipv4 | |
# Allow IPv4 ping | |
config rule | |
option name Allow-Ping | |
option src wan | |
option proto icmp | |
option icmp_type echo-request | |
option family ipv4 | |
option target ACCEPT | |
config rule | |
option name Allow-IGMP | |
option src wan | |
option proto igmp | |
option family ipv4 | |
option target ACCEPT | |
# Allow DHCPv6 replies | |
# see https://dev.openwrt.org/ticket/10381 | |
config rule | |
option name Allow-DHCPv6 | |
option src wan | |
option proto udp | |
option src_ip fc00::/6 | |
option dest_ip fc00::/6 | |
option dest_port 546 | |
option family ipv6 | |
option target ACCEPT | |
config rule | |
option name Allow-MLD | |
option src wan | |
option proto icmp | |
option src_ip fe80::/10 | |
list icmp_type '130/0' | |
list icmp_type '131/0' | |
list icmp_type '132/0' | |
list icmp_type '143/0' | |
option family ipv6 | |
option target ACCEPT | |
# Allow essential incoming IPv6 ICMP traffic | |
config rule | |
option name Allow-ICMPv6-Input | |
option src wan | |
option proto icmp | |
list icmp_type echo-request | |
list icmp_type echo-reply | |
list icmp_type destination-unreachable | |
list icmp_type packet-too-big | |
list icmp_type time-exceeded | |
list icmp_type bad-header | |
list icmp_type unknown-header-type | |
list icmp_type router-solicitation | |
list icmp_type neighbour-solicitation | |
list icmp_type router-advertisement | |
list icmp_type neighbour-advertisement | |
option limit 1000/sec | |
option family ipv6 | |
option target ACCEPT | |
# Allow essential forwarded IPv6 ICMP traffic | |
config rule | |
option name Allow-ICMPv6-Forward | |
option src wan | |
option dest * | |
option proto icmp | |
list icmp_type echo-request | |
list icmp_type echo-reply | |
list icmp_type destination-unreachable | |
list icmp_type packet-too-big | |
list icmp_type time-exceeded | |
list icmp_type bad-header | |
list icmp_type unknown-header-type | |
option limit 1000/sec | |
option family ipv6 | |
option target ACCEPT | |
config rule | |
option name Allow-IPSec-ESP | |
option src wan | |
option dest lan | |
option proto esp | |
option target ACCEPT | |
config rule | |
option name Allow-ISAKMP | |
option src wan | |
option dest lan | |
option dest_port 500 | |
option proto udp | |
option target ACCEPT | |
# include a file with users custom iptables rules | |
config include | |
option path /etc/firewall.user | |
### EXAMPLE CONFIG SECTIONS | |
# do not allow a specific ip to access wan | |
#config rule | |
# option src lan | |
# option src_ip 192.168.45.2 | |
# option dest wan | |
# option proto tcp | |
# option target REJECT | |
# block a specific mac on wan | |
#config rule | |
# option dest wan | |
# option src_mac 00:11:22:33:44:66 | |
# option target REJECT | |
# block incoming ICMP traffic on a zone | |
#config rule | |
# option src lan | |
# option proto ICMP | |
# option target DROP | |
# port redirect port coming in on wan to lan | |
#config redirect | |
# option src wan | |
# option src_dport 80 | |
# option dest lan | |
# option dest_ip 192.168.16.235 | |
# option dest_port 80 | |
# option proto tcp | |
# port redirect of remapped ssh port (22001) on wan | |
#config redirect | |
# option src wan | |
# option src_dport 22001 | |
# option dest lan | |
# option dest_port 22 | |
# option proto tcp | |
### FULL CONFIG SECTIONS | |
#config rule | |
# option src lan | |
# option src_ip 192.168.45.2 | |
# option src_mac 00:11:22:33:44:55 | |
# option src_port 80 | |
# option dest wan | |
# option dest_ip 194.25.2.129 | |
# option dest_port 120 | |
# option proto tcp | |
# option target REJECT | |
#config redirect | |
# option src lan | |
# option src_ip 192.168.45.2 | |
# option src_mac 00:11:22:33:44:55 | |
# option src_port 1024 | |
# option src_dport 80 | |
# option dest_ip 194.25.2.129 | |
# option dest_port 120 | |
# option proto tcp |
config interface 'loopback' | |
option ifname 'lo' | |
option proto 'static' | |
option ipaddr '127.0.0.1' | |
option netmask '255.0.0.0' | |
config globals 'globals' | |
option ula_prefix 'fd5e:9c24:39a3::/48' | |
config interface 'lan' | |
option ifname 'eth0.1' | |
option force_link '1' | |
option type 'bridge' | |
option proto 'static' | |
option ipaddr '192.168.1.1' | |
option netmask '255.255.255.0' | |
option ip6assign '60' | |
config interface 'iptv' | |
option ifname 'eth0.6 eth1.6' | |
option type 'bridge' | |
option proto 'static' | |
option ipaddr '10.10.99.99' | |
option gateway '10.218.255.254' | |
option defaultroute '0' | |
option netmask '255.255.0.0' | |
config interface 'wan' | |
option ifname 'eth1' | |
option proto 'dhcp' | |
config switch | |
option name 'switch0' | |
option reset '1' | |
option enable_vlan '1' | |
config switch_vlan | |
option device 'switch0' | |
option vlan '1' | |
option ports '0 1 5t' | |
config switch_vlan | |
option device 'switch0' | |
option vlan '6' | |
option ports '2 3 5t' |