Untitled diff

Créé Le diff n'expire jamais
0 suppressions
161 lignes
1 ajout
161 lignes


config defaults
config defaults
option syn_flood '1'
option syn_flood '1'
option input 'ACCEPT'
option input 'ACCEPT'
option output 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option forward 'REJECT'


config rule
config rule
option name 'Allow-DHCP-Renew'
option name 'Allow-DHCP-Renew'
option src 'wan'
option src 'wan'
option proto 'udp'
option proto 'udp'
option dest_port '68'
option dest_port '68'
option target 'ACCEPT'
option target 'ACCEPT'
option family 'ipv4'
option family 'ipv4'


config rule
config rule
option name 'Allow-Ping'
option name 'Allow-Ping'
option src 'wan'
option src 'wan'
option proto 'icmp'
option proto 'icmp'
option icmp_type 'echo-request'
option icmp_type 'echo-request'
option family 'ipv4'
option family 'ipv4'
option target 'ACCEPT'
option target 'ACCEPT'


config rule
config rule
option name 'Allow-IGMP'
option name 'Allow-IGMP'
option src 'wan'
option src 'wan'
option proto 'igmp'
option proto 'igmp'
option family 'ipv4'
option family 'ipv4'
option target 'ACCEPT'
option target 'ACCEPT'


config rule
config rule
option name 'Allow-DHCPv6'
option name 'Allow-DHCPv6'
option src 'wan'
option src 'wan'
option proto 'udp'
option proto 'udp'
option src_ip 'fe80::/10'
option src_ip 'fe80::/10'
option src_port '547'
option src_port '547'
option dest_ip 'fe80::/10'
option dest_ip 'fe80::/10'
option dest_port '546'
option dest_port '546'
option family 'ipv6'
option family 'ipv6'
option target 'ACCEPT'
option target 'ACCEPT'


config rule
config rule
option name 'Allow-MLD'
option name 'Allow-MLD'
option src 'wan'
option src 'wan'
option proto 'icmp'
option proto 'icmp'
option src_ip 'fe80::/10'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '132/0'
list icmp_type '143/0'
list icmp_type '143/0'
option family 'ipv6'
option family 'ipv6'
option target 'ACCEPT'
option target 'ACCEPT'


config rule
config rule
option name 'Allow-ICMPv6-Input'
option name 'Allow-ICMPv6-Input'
option src 'wan'
option src 'wan'
option proto 'icmp'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option limit '1000/sec'
option family 'ipv6'
option family 'ipv6'
option target 'ACCEPT'
option target 'ACCEPT'


config rule
config rule
option name 'Allow-ICMPv6-Forward'
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option src 'wan'
option dest '*'
option dest '*'
option proto 'icmp'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option limit '1000/sec'
option family 'ipv6'
option family 'ipv6'
option target 'ACCEPT'
option target 'ACCEPT'


config include
config include
option path '/etc/firewall.user'
option path '/etc/firewall.user'


config rule
config rule
option src 'wan'
option src 'wan'
option dest 'lan'
option dest 'lan'
option proto 'esp'
option proto 'esp'
option target 'ACCEPT'
option target 'ACCEPT'


config rule
config rule
option src 'wan'
option src 'wan'
option dest 'lan'
option dest 'lan'