
config defaults
	option syn_flood '1'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option disabled '0'

config zone
	option name 'nat'
	list network 'nat'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'lan'
	list network 'lan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'nat'
	option dest 'lan'

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
	option name 'Allow-DHCP-Renew'
	option src 'lan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

# Allow IPv4 ping
config rule
	option name 'Allow-Ping'
	option src 'lan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'lan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

# Allow DHCPv6 replies
# see https://dev.openwrt.org/ticket/10381
config rule
	option name 'Allow-DHCPv6'
	option src 'lan'
	option proto 'udp'
	option src_ip 'fe80::/10'
	option src_port '547'
	option dest_ip 'fe80::/10'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'lan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

# Allow essential incoming IPv6 ICMP traffic
config rule
	option name 'Allow-ICMPv6-Input'
	option src 'lan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

# Allow essential forwarded IPv6 ICMP traffic
config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'lan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

# include a file with users custom iptables rules
config include
	option path '/etc/firewall.user'

config rule
	option src 'lan'
	option dest 'nat'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option src 'lan'
	option dest 'nat'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config rule
	option name 'Allow-SSH'
	option target 'ACCEPT'
	option src 'lan'
	option dest_port '22'
	option proto 'tcp'
	option family 'ipv4'

config rule
	option name 'Allow-SSH-v6'
	option target 'ACCEPT'
	option src 'lan'
	option dest_port '22'
	option proto 'tcp'
	option family 'ipv6'

# port redirect port coming in on wan to lan
#config redirect
#	option src			wan
#	option src_dport	80
#	option dest			lan
#	option dest_ip		192.168.16.235
#	option dest_port	80
#	option proto		tcp

# port redirect of remapped ssh port (22001) on wan
#config redirect
#	option src		wan
#	option src_dport	22001
#	option dest		lan
#	option dest_port	22
#	option proto		tcp

# allow IPsec/ESP and ISAKMP passthrough
config rule
	option name 'Allow-gdb'
	option target 'ACCEPT'
	option src 'lan'
	option dest_port '2000'
	option proto 'tcp'
	option family 'ipv4'

config rule
	option name 'Allow-localGUI'
	option target 'ACCEPT'
	option src 'lan'
	option dest_port '80'
	option proto 'tcp'
	option family 'ipv4'

config include 'map'
	option type 'script'
	option path '/etc/firewall.d/map_firewall'
	option family 'any'
	option reload '1'

config include 'miniupnpd'
	option type 'script'
	option path '/usr/share/miniupnpd/firewall.include'
	option family 'any'
	option reload '1'

config include 'qcanssecm'
	option type 'script'
	option path '/etc/firewall.d/qca-nss-ecm'
	option family 'any'
	option reload '1'

