Re: [Cerowrt-devel] zones for other subnets

[Dave Taht <dave.taht@gmail.com>]

It's not quite clear what you want from the description. in the case
of two cerowrt routers on different subnets connected over ethernet or
the babel ssid, they just route automatically, no firewall rules
required, so long as they are on different IP subnets

If the other router is not running babel, then you need to inject a
static route on both sides, to get between points A and B.

So that would be something like

ip route add 209.87.252.192/28 via the_den_routers_ip

and vice versa on the den router. There is also a gui option for this.

From a firewalling perspective, dealing with guest interfaces in
particular is trickier.

On Wed, Nov 21, 2012 at 3:03 AM, Michael Richardson <mcr@sandelman.ca> wrote:
>
> I have a routed wifi in my Den.
> It's not directly connected to my cerowrt.
> It's routed on a wired network that the cerowrt.
>
> Is there a way in the UI for me to write a firewall rule to let
> packets in/out of it?  If I could create a zone based upon just
> the subnet, it would work, but it seems that I can only define
> covered networks by defining an interface on that network.
>
> Basically, I need to put:
>
> iptables -I FORWARD -s 209.87.252.192/28 -d 0.0.0.0/0 -j ACCEPT
> iptables -I FORWARD -d 209.87.252.192/28 -s 0.0.0.0/0 -j ACCEPT
>
> and I've even put this into "Custom Rules", but it doesn't seem to take.
>
> --
> ]       He who is tired of Weird Al is tired of life!           |  firewalls  [
> ]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
> ] mcr@sandelman.ottawa.on.ca http://www.sandelman.ottawa.on.ca/ |device driver[
>    Kyoto Plus: watch the video <http://www.youtube.com/watch?v=kzx1ycLXQSE>
>                        then sign the petition.
>
> _______________________________________________
> Cerowrt-devel mailing list
> Cerowrt-devel@lists.bufferbloat.net
> https://lists.bufferbloat.net/listinfo/cerowrt-devel



-- 
Dave Täht

Fixing bufferbloat with cerowrt: http://www.teklibre.com/cerowrt/subscribe.html