Mirrors
/
aredn
mirror of https://github.com/aredn/aredn.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
aredn/files/etc/config.mesh/firewall

201 lines
5.1 KiB
Plaintext
Raw Normal View History

Merge SDWG Mesh progress with 1.0.0 BBHN Includes removing files that are provided by packages instead of being embedded as binaries. Changes made for UBNT hardware AND for newer base openwrt (Backfire)
2013-12-02 13:04:54 -07:00
config defaults
option syn_flood 1
option input ACCEPT
option output ACCEPT
option forward REJECT
# Uncomment this line to disable ipv6 rules
# option disable_ipv6 1
config zone
option name lan
option network 'lan'
option input ACCEPT
option output ACCEPT
option forward REJECT
config zone
option name wan
option network 'wan'
option input REJECT
option output ACCEPT
option forward REJECT
option masq 1
option mtu_fix 1
config zone
option name wifi
option network 'wifi'
option input REJECT
option output ACCEPT
option forward REJECT
option masq 1
option mtu_fix 1
Add new feature device-to-device linking (dtdlink) The dtdlink interface is vlan 2 on eth0 and is used for linking two or more devices together. This will allow for band-to-band repeaters, sector antenna setups, etc. see BBHN->ticket:28
2014-04-09 00:19:45 -06:00
config zone
option name dtdlink
option network 'dtdlink'
option input REJECT
option output ACCEPT
option forward REJECT
option mtu_fix 1
Merge SDWG Mesh progress with 1.0.0 BBHN Includes removing files that are provided by packages instead of being embedded as binaries. Changes made for UBNT hardware AND for newer base openwrt (Backfire)
2013-12-02 13:04:54 -07:00
config forwarding
option src lan
option dest wan
config forwarding
option src lan
option dest wifi
Add rule to allow wifi to forward traffic to wifi Previous rules would of not allowed mesh traffic to be forwarded out.
2013-12-04 20:29:42 -07:00
config forwarding
option src wifi
option dest wifi
Merge SDWG Mesh progress with 1.0.0 BBHN Includes removing files that are provided by packages instead of being embedded as binaries. Changes made for UBNT hardware AND for newer base openwrt (Backfire)
2013-12-02 13:04:54 -07:00
Add new feature device-to-device linking (dtdlink) The dtdlink interface is vlan 2 on eth0 and is used for linking two or more devices together. This will allow for band-to-band repeaters, sector antenna setups, etc. see BBHN->ticket:28
2014-04-09 00:19:45 -06:00
config forwarding
option src lan
option dest dtdlink
config forwarding
option src wifi
option dest dtdlink
config forwarding
option src dtdlink
option dest wifi
Merge SDWG Mesh progress with 1.0.0 BBHN Includes removing files that are provided by packages instead of being embedded as binaries. Changes made for UBNT hardware AND for newer base openwrt (Backfire)
2013-12-02 13:04:54 -07:00
# Allow IPv4 ping
config rule
option name Allow-Ping
option src wifi
option proto icmp
option icmp_type echo-request
option family ipv4
option target ACCEPT
Add new feature device-to-device linking (dtdlink) The dtdlink interface is vlan 2 on eth0 and is used for linking two or more devices together. This will allow for band-to-band repeaters, sector antenna setups, etc. see BBHN->ticket:28
2014-04-09 00:19:45 -06:00
config rule
option name Allow-Ping
option src dtdlink
option proto icmp
option icmp_type echo-request
option family ipv4
option target ACCEPT
feature: FirewallIncludes: Add program that will auto include firewall rules that are in a set directory. This is the basis for allowing packages to contain firewall rules that can be just dropped in a folder at install time.
2016-01-09 16:01:30 -07:00
config include
option path /usr/local/bin/mesh-firewall
option reload 1
Merge SDWG Mesh progress with 1.0.0 BBHN Includes removing files that are provided by packages instead of being embedded as binaries. Changes made for UBNT hardware AND for newer base openwrt (Backfire)
2013-12-02 13:04:54 -07:00
config include
option path /etc/firewall.user
config rule
option src wan
option dest_port 2222
option proto tcp
option target ACCEPT
config rule
option src wan
option dest_port 8080
option proto tcp
option target ACCEPT
config change to make uhttpd listen on port 80 and 8080 (#142) * config change to make uhttpd listen on port 80 and 8080 * add port 80 to tunnel firewall rules * add port 80 to tunnel firewall rules in config, update help * firewall rules for wan + dtdlink
2018-08-20 13:09:47 -06:00
config rule
option src wan
option dest_port 80
option proto tcp
option target ACCEPT
aredn: allow wan ping (#544) fixes: #509
2020-06-24 20:08:06 -06:00
config rule
option name Allow-Ping
option src wan
option proto icmp
option icmp_type echo-request
option family ipv4
option target ACCEPT
Merge SDWG Mesh progress with 1.0.0 BBHN Includes removing files that are provided by packages instead of being embedded as binaries. Changes made for UBNT hardware AND for newer base openwrt (Backfire)
2013-12-02 13:04:54 -07:00
config rule
option src wifi
option dest_port 2222
option proto tcp
Prepwork for dealing with the common encrypted ports. In order to maintain compatibility with existing deployed nodes, known common encrypted ports will NOT be blocked by default. Users will receive a message during first setup encouraging them to review the rules that apply to how they intend to use their node and that laws very by country and frequency. A package blockknownencrypted has been created in changeset:123a521df2b63ba1c5bdd6ad94ac402b86394579/bbhn_packages to be used in blocking known encrypted ports if the user feels it is necessary. As developers we are not stating an opinion as to what the rules say or do not say in relationship to the traffic this deals with. Each user will need to make their own determination of the rules. This has been the current case since day one. New file fwinfo page shows if the package is installed AND displays the active firewall rules at the time of the access. This allows future grown to help test (because of the adhoc nature of the mesh) if packet filtering is the cause of a connection not working. see BBHN->ticket:3
2014-01-28 14:05:58 -07:00
option target ACCEPT
Merge SDWG Mesh progress with 1.0.0 BBHN Includes removing files that are provided by packages instead of being embedded as binaries. Changes made for UBNT hardware AND for newer base openwrt (Backfire)
2013-12-02 13:04:54 -07:00
config rule
option src wifi
option dest_port 8080
option proto tcp
option target ACCEPT
config change to make uhttpd listen on port 80 and 8080 (#142) * config change to make uhttpd listen on port 80 and 8080 * add port 80 to tunnel firewall rules * add port 80 to tunnel firewall rules in config, update help * firewall rules for wan + dtdlink
2018-08-20 13:09:47 -06:00
config rule
option src wifi
option dest_port 80
option proto tcp
option target ACCEPT
Merge SDWG Mesh progress with 1.0.0 BBHN Includes removing files that are provided by packages instead of being embedded as binaries. Changes made for UBNT hardware AND for newer base openwrt (Backfire)
2013-12-02 13:04:54 -07:00
config rule
option src wifi
option dest_port 698
option proto udp
option target ACCEPT
Open firewall to port 23 on WIFI in config=mesh ref ticket: #2 Open firewall to allow telnet to the routers WIFI interface in mesh mode. closes #2
2013-12-07 19:38:47 -07:00
config rule
option src wifi
option dest_port 23
option proto tcp
option target ACCEPT
Add new feature device-to-device linking (dtdlink) The dtdlink interface is vlan 2 on eth0 and is used for linking two or more devices together. This will allow for band-to-band repeaters, sector antenna setups, etc. see BBHN->ticket:28
2014-04-09 00:19:45 -06:00
config rule
option src dtdlink
option dest_port 2222
option proto tcp
option target ACCEPT
config rule
option src dtdlink
option dest_port 8080
option proto tcp
option target ACCEPT
config change to make uhttpd listen on port 80 and 8080 (#142) * config change to make uhttpd listen on port 80 and 8080 * add port 80 to tunnel firewall rules * add port 80 to tunnel firewall rules in config, update help * firewall rules for wan + dtdlink
2018-08-20 13:09:47 -06:00
config rule
option src dtdlink
option dest_port 80
option proto tcp
option target ACCEPT
Add new feature device-to-device linking (dtdlink) The dtdlink interface is vlan 2 on eth0 and is used for linking two or more devices together. This will allow for band-to-band repeaters, sector antenna setups, etc. see BBHN->ticket:28
2014-04-09 00:19:45 -06:00
config rule
option src dtdlink
option dest_port 698
option proto udp
option target ACCEPT
config rule
option src dtdlink
option dest_port 23
option proto tcp
option target ACCEPT
feature: Add initial read-only SNMP support in mesh mode. Config file is present upon initial start and in mesh mode. Daemon still starts up in other modes but will not function w/o settings. Firewall: Permit access for UDP:161 (SNMPD) on WIFI and DTDLINK Lan is permitted by default allow rules.
2015-04-14 23:31:21 -06:00
#SNMPD
config rule
option src wifi
option dest_port 161
option proto udp
option target ACCEPT
config rule
option src dtdlink
option dest_port 161
option proto udp
option target ACCEPT
feature: add jsoninfo to olsr and open firewall ports 9090
2016-01-05 11:00:22 -07:00
# olsr jsoninfo
config rule
option src wifi
option dest_port 9090
option proto tcp
option target ACCEPT
config rule
option src dtdlink
option dest_port 9090
option proto tcp
option target ACCEPT