6 # Uncomment this line to disable ipv6 rules
7 # option disable_ipv6 1
18 option network 'wan wan6'
29 # We need to accept udp packets on port 68,
30 # see https://dev.openwrt.org/ticket/4108
32 option name Allow-DHCP-Renew
41 option name Allow-Ping
44 option icmp_type echo-request
48 # Allow DHCPv6 replies
49 # see https://dev.openwrt.org/ticket/10381
51 option name Allow-DHCPv6
54 option src_ip fe80::/10
56 option dest_ip fe80::/10
61 # Allow essential incoming IPv6 ICMP traffic
63 option name Allow-ICMPv6-Input
66 list icmp_type echo-request
67 list icmp_type echo-reply
68 list icmp_type destination-unreachable
69 list icmp_type packet-too-big
70 list icmp_type time-exceeded
71 list icmp_type bad-header
72 list icmp_type unknown-header-type
73 list icmp_type router-solicitation
74 list icmp_type neighbour-solicitation
75 list icmp_type router-advertisement
76 list icmp_type neighbour-advertisement
81 # Allow essential forwarded IPv6 ICMP traffic
83 option name Allow-ICMPv6-Forward
87 list icmp_type echo-request
88 list icmp_type echo-reply
89 list icmp_type destination-unreachable
90 list icmp_type packet-too-big
91 list icmp_type time-exceeded
92 list icmp_type bad-header
93 list icmp_type unknown-header-type
98 # include a file with users custom iptables rules
100 option path /etc/firewall.user
103 ### EXAMPLE CONFIG SECTIONS
104 # do not allow a specific ip to access wan
107 # option src_ip 192.168.45.2
110 # option target REJECT
112 # block a specific mac on wan
115 # option src_mac 00:11:22:33:44:66
116 # option target REJECT
118 # block incoming ICMP traffic on a zone
124 # port redirect port coming in on wan to lan
127 # option src_dport 80
129 # option dest_ip 192.168.16.235
130 # option dest_port 80
133 # port redirect of remapped ssh port (22001) on wan
136 # option src_dport 22001
138 # option dest_port 22
141 # allow IPsec/ESP and ISAKMP passthrough
145 # option protocol esp
146 # option target ACCEPT
151 # option src_port 500
152 # option dest_port 500
154 # option target ACCEPT
156 ### FULL CONFIG SECTIONS
159 # option src_ip 192.168.45.2
160 # option src_mac 00:11:22:33:44:55
163 # option dest_ip 194.25.2.129
164 # option dest_port 120
166 # option target REJECT
170 # option src_ip 192.168.45.2
171 # option src_mac 00:11:22:33:44:55
172 # option src_port 1024
173 # option src_dport 80
174 # option dest_ip 194.25.2.129
175 # option dest_port 120