[Cerowrt-devel] saner defaults for config/firewall

[Vincent Frentzel <zcecc22@c3r.es>]

[-- Attachment #1.1: Type: text/plain, Size: 549 bytes --]

Hi everyone,

After installing ceroWRT the first thing I did was to reconfigure the
firewall as shown attached. My router is used as home gateway and I wanted
to lock down the device a bit.

The changes are introduced are as follow:

- LAN (s+) to/from GUEST (g+) is not allowed.
- GUEST to ROUTER is restricted to DNS/DHCP/NTP.
- I've tuned the basic IPV6 rules to take the above changes into account
and allow proto 41 INPUT for 6to/in4 tunnels.
- LAN to/from ROUTER everything is allowed.

This could be a nice default config.

Feedback welcome.

[-- Attachment #1.2: Type: text/html, Size: 729 bytes --]

[-- Attachment #2: firewall --]
[-- Type: application/octet-stream, Size: 3569 bytes --]


config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option drop_invalid '1'
	option synflood_protect '1'
	option synflood_rate '200/s'
	option synflood_burst '500'
	option tcp_ecn '1'

config zone
	option input 'DROP'
	option forward 'DROP'
	option output 'ACCEPT'
	option name 'wan'
	option masq '1'
	option mtu_fix '1'
	option network 'ge00 wan6'

config zone
	option input 'ACCEPT'
	option forward 'ACCEPT'
	option output 'ACCEPT'
	option name 'lan'
	option device 's+'

config forwarding
	option dest 'wan'
	option src 'lan'

config zone
	option input 'REJECT'
	option output 'ACCEPT'
	option name 'guest'
	option forward 'ACCEPT'
	option device 'gw+'

config forwarding
	option dest 'wan'
	option src 'guest'

config rule
        option src      wan
        option proto    41
        option target   ACCEPT
        option name '6TO4'

config rule
	option target 'ACCEPT'
	option proto 'tcp udp'
	option dest_port '53'
	option name 'DNS-GUEST'
	option src 'guest'

config rule
	option target 'ACCEPT'
	option proto 'udp'
	option dest_port '123'
	option name 'NTP-GUEST'
	option src 'guest'

config rule
	option target 'ACCEPT'
	option family 'ipv4'
	option proto 'udp'
	option dest_port '68'
	option src 'guest'
	option name 'DHCPv4-GUEST'

config rule
	option target 'ACCEPT'
	option family 'ipv4'
	option proto 'udp'
	option dest_port '68'
	option src 'wan'
	option name 'DHCPv4-WAN'

config rule
	option src 'wan'
	option proto 'udp'
	option src_ip 'fe80::/10'
	option src_port '547'
	option dest_ip 'fe80::/10'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'
	option name 'DHCPv6-WAN'

config rule
	option src 'guest'
	option proto 'udp'
	option src_ip 'fe80::/10'
	option src_port '547'
	option dest_ip 'fe80::/10'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'
	option name 'DHCPv6-GUEST'

config include
	option path '/etc/firewall.user'

config rule
	option name 'ICMPv6-WAN'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '200/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'ICMPv6-GUEST'
	option src 'guest'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '200/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'ICMPv6-FORWARD'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '200/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config include 'miniupnpd'
	option type 'script'
	option path '/usr/share/miniupnpd/firewall.include'
	option family 'IPv4'
	option reload '1'