6 # Uncomment this line to disable ipv6 rules
7 # option disable_ipv6 1
18 option network 'wan wan6'
29 # We need to accept udp packets on port 68,
30 # see https://dev.openwrt.org/ticket/4108
32 option name Allow-DHCP-Renew
41 option name Allow-Ping
44 option icmp_type echo-request
48 # Allow DHCPv6 replies
49 # see https://dev.openwrt.org/ticket/10381
51 option name Allow-DHCPv6
54 option src_ip fe80::/10
56 option dest_ip fe80::/10
61 # Allow essential incoming IPv6 ICMP traffic
63 option name Allow-ICMPv6-Input
66 list icmp_type echo-request
67 list icmp_type echo-reply
68 list icmp_type destination-unreachable
69 list icmp_type packet-too-big
70 list icmp_type time-exceeded
71 list icmp_type bad-header
72 list icmp_type unknown-header-type
73 list icmp_type router-solicitation
74 list icmp_type neighbour-solicitation
75 list icmp_type router-advertisement
76 list icmp_type neighbour-advertisement
81 # Allow essential forwarded IPv6 ICMP traffic
83 option name Allow-ICMPv6-Forward
87 list icmp_type echo-request
88 list icmp_type echo-reply
89 list icmp_type destination-unreachable
90 list icmp_type packet-too-big
91 list icmp_type time-exceeded
92 list icmp_type bad-header
93 list icmp_type unknown-header-type
98 # include a file with users custom iptables rules
100 option path /etc/firewall.user
102 # include IPv6 ULA-border
105 option path /usr/share/firewall/ipv6-ula-border.sh
110 ### EXAMPLE CONFIG SECTIONS
111 # do not allow a specific ip to access wan
114 # option src_ip 192.168.45.2
117 # option target REJECT
119 # block a specific mac on wan
122 # option src_mac 00:11:22:33:44:66
123 # option target REJECT
125 # block incoming ICMP traffic on a zone
131 # port redirect port coming in on wan to lan
134 # option src_dport 80
136 # option dest_ip 192.168.16.235
137 # option dest_port 80
140 # port redirect of remapped ssh port (22001) on wan
143 # option src_dport 22001
145 # option dest_port 22
148 # allow IPsec/ESP and ISAKMP passthrough
152 # option protocol esp
153 # option target ACCEPT
158 # option src_port 500
159 # option dest_port 500
161 # option target ACCEPT
163 ### FULL CONFIG SECTIONS
166 # option src_ip 192.168.45.2
167 # option src_mac 00:11:22:33:44:55
170 # option dest_ip 194.25.2.129
171 # option dest_port 120
173 # option target REJECT
177 # option src_ip 192.168.45.2
178 # option src_mac 00:11:22:33:44:55
179 # option src_port 1024
180 # option src_dport 80
181 # option dest_ip 194.25.2.129
182 # option dest_port 120