rendered paste body#!/bin/sh /etc/rc.common# Copyright (C) 2006-2008 OpenWrt.orgapply_rules(){ cat /tmp/rules.$$.* |iptables-restore rm -f /tmp/rules.$$.*}chain_policy(){ table="$3" [ -z "$table" ] && table=filter echo ":$1 $2 [0:0]" >> "/tmp/rules.$$.$table"}new_chain(){ table="$2" [ -z "$table" ] && table=filter echo ":$1 - [0:0]" >> "/tmp/rules.$$.$table"}add_rule(){ table="$2" [ -z "$table" ] && table=filter echo "$1" >> "/tmp/rules.$$.$table"}## Please make changes in /etc/firewall.userSTART=45start() { include /lib/network scan_interfaces config_get WAN wan ifname config_get WANDEV wan device config_get LAN lan ifname config_get_bool NAT_LAN lan nat 1 if [ $NAT_LAN -ne 0 ] then config_get LAN_MASK lan netmask config_get LAN_IP lan ipaddr LAN_NET=$(/bin/ipcalc.sh $LAN_IP $LAN_MASK | grep NETWORK | cut -d= -f2) fi ## CLEAR TABLES echo '*filter' > /tmp/rules.$$.filter echo '*nat' > /tmp/rules.$$.nat new_chain input_rule new_chain input_wan new_chain output_rule new_chain input_rule new_chain forwarding_rule new_chain forwarding_wan new_chain prerouting_rule nat new_chain prerouting_wan nat new_chain postrouting_rule nat new_chain LAN_ACCEPT [ -z "$WAN" ] || add_rule "-A LAN_ACCEPT -i $WAN -j RETURN" [ -z "$WANDEV" -o "$WANDEV" = "$WAN" ] || add_rule "-A LAN_ACCEPT -i $WANDEV -j RETURN" add_rule '-A LAN_ACCEPT -j ACCEPT' ### INPUT ### (connections with the router as destination) # base case chain_policy INPUT DROP add_rule '-A INPUT -m state --state INVALID -j DROP' add_rule '-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT' add_rule '-A INPUT -p tcp --tcp-flags SYN SYN --tcp-option ! 2 -j DROP' # # insert accept rule or to jump to new accept-check table here # add_rule '-A INPUT -j input_rule' [ -z "$WAN" ] || add_rule "-A INPUT -i $WAN -j input_wan" # allow add_rule '-A INPUT -j LAN_ACCEPT' # allow from lan/wifi interfaces add_rule '-A INPUT -p icmp -j ACCEPT' # allow ICMP add_rule '-A INPUT -p gre -j ACCEPT' # allow GRE # reject (what to do with anything not allowed earlier) add_rule '-A INPUT -p tcp -j REJECT --reject-with tcp-reset' add_rule '-A INPUT -j REJECT --reject-with icmp-port-unreachable' ### OUTPUT ### (connections with the router as source) # base case chain_policy '-P OUTPUT DROP' add_rule '-A OUTPUT -m state --state INVALID -j DROP' add_rule '-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT' # # insert accept rule or to jump to new accept-check table here # add_rule '-A OUTPUT -j output_rule' # allow add_rule '-A OUTPUT -j ACCEPT' #allow everything out # reject (what to do with anything not allowed earlier) add_rule '-A OUTPUT -p tcp -j REJECT --reject-with tcp-reset' add_rule '-A OUTPUT -j REJECT --reject-with icmp-port-unreachable' ### FORWARDING ### (connections routed through the router) # base case chain_policy '-P FORWARD DROP' add_rule '-A FORWARD -m state --state INVALID -j DROP' add_rule '-A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu' add_rule '-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT' # # insert accept rule or to jump to new accept-check table here # add_rule '-A FORWARD -j forwarding_rule' [ -z "$WAN" ] || add_rule "-A FORWARD -i $WAN -j forwarding_wan" # allow add_rule "-A FORWARD -i $LAN -o $LAN -j ACCEPT" [ -z "$WAN" ] || add_rule "-A FORWARD -i $LAN -o $WAN -j ACCEPT" # reject (what to do with anything not allowed earlier) # uses the default -P DROP ### MASQ add_rule '-A PREROUTING -m state --state NEW -p tcp -j NEW' nat add_rule '-A PREROUTING -j prerouting_rule' nat [ -z "$WAN" ] || add_rule "-A PREROUTING -i $WAN -j prerouting_wan" nat add_rule '-A POSTROUTING -j postrouting_rule' ### Only LAN, unless told not to if [ $NAT_LAN -ne 0 ] then [ -z "$WAN" ] || add_rule "-A POSTROUTING --src $LAN_NET/$LAN_MASK -o $WAN -j MASQUERADE" nat fi add_rule '-A NEW -m limit --limit 50 --limit-burst 100 -j RETURN' nat && \ add_rule '-A NEW -j DROP' nat ## USER RULES # unsupported yet apply_rules}stop() { cat >/tmp/rules.$$.filter << 'EOF'*filter:INPUT ACCEPT [0:0]:FORWARD ACCEPT [0:0]:OUTPUT ACCEPT [0:0]COMMITEOF cat >/tmp/rules.$$.nat << 'EOF'*nat:PREROUTING ACCEPT [0:0]:POSTROUTING ACCEPT [0:0]:OUTPUT ACCEPT [0:0]EOF apply_rules}