09.OpenWrt-防火墙

防火墙是OPenWrt非常重要的一部分,基础篇只说防火墙的配置和一些常用的命令.

9.1 防火墙配置文件

root@Togetek:/# cat /etc/config/firewallconfig defaultsoption syn_flood        1option input            REJECToption output           ACCEPToption forward          REJECT# Uncomment this line to disable ipv6 rules#       option disable_ipv6     1config zoneoption name             lanlist   network          'lan'option input            ACCEPToption output           ACCEPToption forward          ACCEPTconfig zoneoption name             wanlist   network          'wan'list   network          'wan6'option input            ACCEPToption output           ACCEPToption forward          REJECToption masq             1option mtu_fix          1config forwardingoption src              lanoption dest             wan# We need to accept udp packets on port 68,# see https://dev.openwrt.org/ticket/4108config ruleoption name             Allow-DHCP-Renewoption src              wanoption proto            udpoption dest_port        68option target           ACCEPToption family           ipv4# Allow IPv4 pingconfig ruleoption name             Allow-Pingoption src              wanoption proto            icmpoption icmp_type        echo-requestoption family           ipv4option target           ACCEPTconfig ruleoption name             Allow-IGMPoption src              wanoption proto            igmpoption family           ipv4option target           ACCEPT# Allow DHCPv6 replies# see https://github.com/openwrt/openwrt/issues/5066config ruleoption name             Allow-DHCPv6option src              wanoption proto            udpoption dest_port        546option family           ipv6option target           ACCEPTconfig ruleoption name             Allow-MLDoption src              wanoption proto            icmpoption src_ip           fe80::/10list icmp_type          '130/0'list icmp_type          '131/0'list icmp_type          '132/0'list icmp_type          '143/0'option family           ipv6option target           ACCEPT# Allow essential incoming IPv6 ICMP trafficconfig ruleoption name             Allow-ICMPv6-Inputoption src              wanoption proto    icmplist icmp_type          echo-requestlist icmp_type          echo-replylist icmp_type          destination-unreachablelist icmp_type          packet-too-biglist icmp_type          time-exceededlist icmp_type          bad-headerlist icmp_type          unknown-header-typelist icmp_type          router-solicitationlist icmp_type          neighbour-solicitationlist icmp_type          router-advertisementlist icmp_type          neighbour-advertisementoption limit            1000/secoption family           ipv6option target           ACCEPT# Allow essential forwarded IPv6 ICMP trafficconfig ruleoption name             Allow-ICMPv6-Forwardoption src              wanoption dest             *option proto            icmplist icmp_type          echo-requestlist icmp_type          echo-replylist icmp_type          destination-unreachablelist icmp_type          packet-too-biglist icmp_type          time-exceededlist icmp_type          bad-headerlist icmp_type          unknown-header-typeoption limit            1000/secoption family           ipv6option target           ACCEPTconfig ruleoption name             Allow-IPSec-ESPoption src              wanoption dest             lanoption proto            espoption target           ACCEPTconfig ruleoption name             Allow-ISAKMPoption src              wanoption dest             lanoption dest_port        500option proto            udpoption target           ACCEPT# allow interoperability with traceroute classic# note that traceroute uses a fixed port range, and depends on getting# back ICMP Unreachables.  if we're operating in DROP mode, it won't# work so we explicitly REJECT packets on these ports.config ruleoption name             Support-UDP-Tracerouteoption src              wanoption dest_port        33434:33689option proto            udpoption family           ipv4option target           REJECToption enabled          false# include a file with users custom iptables rulesconfig includeoption path /etc/firewall.user### EXAMPLE CONFIG SECTIONS# do not allow a specific ip to access wan#config rule#       option src              lan#       option src_ip   192.168.45.2#       option dest             wan#       option proto    tcp#       option target   REJECT# block a specific mac on wan#config rule#       option dest             wan#       option src_mac  00:11:22:33:44:66#       option target   REJECT# block incoming ICMP traffic on a zone#config rule#       option src              lan#       option proto    ICMP#       option target   DROP# port redirect port coming in on wan to lan#config redirect#       option src                      wan#       option src_dport        80#       option dest                     lan#       option dest_ip          192.168.16.235#       option dest_port        80#       option proto            tcp# port redirect of remapped ssh port (22001) on wan#config redirect#       option src              wan#       option src_dport        22001#       option dest             lan#       option dest_port        22#       option proto            tcp### FULL CONFIG SECTIONS#config rule#       option src              lan#       option src_ip   192.168.45.2#       option src_mac  00:11:22:33:44:55#       option src_port 80#       option dest             wan#       option dest_ip  194.25.2.129#       option dest_port        120#       option proto    tcp#       option target   REJECT#config redirect#       option src              lan#       option src_ip   192.168.45.2#       option src_mac  00:11:22:33:44:55#       option src_port         1024#       option src_dport        80#       option dest_ip  194.25.2.129#       option dest_port        120#       option proto    tcp

9.2 防火墙常用操作

   #阻止防火墙服务开机自动启动/etc/init.d/firewall disable#关闭防火墙/etc/init.d/firewall stop#开启防火墙/etc/init.d/firewall start#重启防火墙/etc/init.d/firewall restart

09.OpenWrt-防火墙相关推荐

万字讲解OpenWrt防火墙iptables，并使用UCI配置防火墙
一.防火墙简介 "防火墙"(Firewall)术语来自建筑设计领域,是指用来起分割作用的墙,当某一部分着火时可以减缓或保护其他部分免受火灾影响.在计算机网络中,防火墙是在两个或多 ...
关闭防火墙_从零开始学Linux运维|09.关闭防火墙和SElinux
firewalld是centos7默认的防火墙安全增强型 Linux(Security-Enhanced Linux)简称 SELinux 初学者建议先关闭,等熟悉了之后再来使用前期联系中的好多错 ...
openwrt 防火墙
防火墙一:开启防火墙二:配置防火墙三:关闭防火墙一:开启防火墙二:配置防火墙配置文件修改位置: lede_17.01/package/network/config/firewall/fil ...
OpenWrt上搭建纯L2TP服务器[ZT]
转自:http://www.openwrt.pro/post-389.html 纯L2TP(l2tp + ppp,无IPSec) 首先安装xl2tpd软件包 opkg update opkg inst ...
openwrt固件的下载编译流程
openwrt官方wiki http://wiki.openwrt.org/doc/howto/start Ubuntu环境: Linux wilson-virtual-machine 4.10.0- ...
OpenWRT学习笔记（1）环境部署代码下载及编译
一 . 安装虚拟机,我选择安装ubuntu14.04版本. 二. 安装编译工具更新ubuntu软件仓库中软件包的索引文件. sudo apt-get update 安装如下工具: sudo apt- ...
OpenWrt开发指南博文导航
自博主更新该专栏也很久了,今天博主就给出关于OpenWrt开发的一个导航,为的是读者朋友能更好找到自己所感兴趣的那一块,当然博主以后对OpenWrt有新的发现和想法也会在第一时间发表在CSDN上,在此 ...
openwrt入门经典案例
一:下载编译编译出来的镜像位于 bin 目录下面其中 openwrt-ramips-rt305x-mpr-a2-squashfs-sysupgrade.bin 这个就是我们要的镜像.烧写到板子上面 ...
Openwrt旁路由设置vs无法打开国内网站解决方法。
20230427经测试,国内不能上网,就关passwall2 :开SSRP+影响国内网:兼容国内网络,最好开Hello World .最主要是DNS的问题,DNS解析到位开任何软件都能全球网. Ope ...
openwrt 版本下载
openwrt 源码下载.官网地址如下: http://git.openwrt.org/ 可以看到有很多版本 10.03/openwrt.git OpenWrt 10.03 release branc ...

09.OpenWrt-防火墙

09.OpenWrt-防火墙

9.1 防火墙配置文件

9.2 防火墙常用操作

09.OpenWrt-防火墙相关推荐

最新文章

热门文章