Openwrt修改防火墙规则

一时失言乱红尘 2021-12-17 12:43 2538阅读 0赞

本文翻译自 [OpenWrt WIKI][]

**目录**

防火墙配置 /etc/config/firewall

管理

WebUI

CLI

配置部分

Defaults

Includes

Redirects

Zones

Forwardings

Rules

Routing

IP Sets

IPv6

SNAT

--------------------

# 防火墙配置 `/etc/config/firewall` #

openwrt 的防火墙管理应用`fw3`有三种配置机制:

配置文件：

*  `/etc/firewall.user`
 *  `/etc/config/firewall`

本文主要关注配置文件和其内容，LUCI和UCI是用户抽象，最终也是修改的配置文件。

## 管理 ##

*  主要的防火墙配置文件是`/etc/config/firewall`， 编辑该文件修改防火墙设置。
    
     *  修改之前先备份
     *  一旦修改设置之后，确认无误后，通过`/etc/init.d/firwwall reload`重载防火墙（使用`fw3 reload`指令更简单，并且会检查配置文件是否有错误。
 *  任何第一个字符是`#`的行都不会解析，用作注释
 *  UCI在`/etc/config/firewall`中的防火墙配置包含网络过滤规则的部分合理子集，但并不是全部。
 *  尽可能的使用`fw3`防火墙UCI配置。有一些场景必须要用iptables,参见[Netfilter in OpenWrt][]

## WebUI ##

LuCI是一种很好的观察和修改防火墙配置的机制。

*  它在`Network --> Firewall` 并且紧密映射到配置文件部分。
 *  修改防火墙配置它会花费多一些时间，但是它却比配置文件具有更高的组织结构。

修改参数和重载使用`保存&应用`按钮.

*  LUCI会移除`/etc/config/firewall`所有的注释\[\#\]行。

## CLI ##

UCI是配置文件的一种低级抽象，其可用远程通过ssh接触。

uci add firewall rule
    uci set firewall.@rule[-1].target='REJECT'
    uci set firewall.@rule[-1].proto='tcp udp icmp'
    uci set firewall.@rule[-1].src='vpn'
    uci set firewall.@rule[-1].dest='lan'
    uci set firewall.@rule[-1].name='Reject All VPN -> LAN Traffic'
    uci commit firewall
    service firewall restart

这将会假定最后一条规则是`VPN --> LAN`转发链，所有从VPN来的包都会被拒绝。  
显示防火墙配置：

# uci show firewall
    firewall.@rule[20]=rule
    firewall.@rule[20].target='REJECT'
    firewall.@rule[20].proto='tcp udp icmp'
    firewall.@rule[20].src='wan'
    firewall.@rule[20].dest='lan'
    firewall.@rule[20].name='Reject All VPN -> LAN Traffic'

UCI用来查看防火墙配置非常方便，但是因为以下几个原因一般不用做来修改配置

*  必须要熟悉防火墙规则才能使规则数组工作。
 *  `uci`不识别`/etc/firewall.user`脚本中的内容。
 *  `uci commit`是保存配置所必需的，但是依旧需要调用`/etc/init.d/firewall reload`去重载新表

## 配置部分 ##

以下是被定义的防火墙配置概览：

*  路由器的一个最小的配置通常包含一些默认部分，至少有两块（lan和wan）和一个允许从lan到wan的转发。
    
     *  当不超过两个区域时，转发部分不是必要的，因为可以将该规则设置为该区域的“全局缺省”。

### Defaults ###

defaults（默认）节的声明是全局的防火墙设置声明，不属于某一个特定节。

config defaults
        option  input                 'ACCEPT'
        option  output                'ACCEPT'
        option  forward               'REJECT'
        option  custom_chains         '1'
        option  drop_invalid          '1'
        option  syn_flood             '1'
        option  synflood_burst        '50'
        option  synflood_protect      '1'
        option  tcp_ecn               '1'
        option  tcp_syncookies        '1'
        option  tcp_window_scaling    '1'

Options

<table> 
 <thead> 
 <tr> 
 <th>Name</th> 
 <th>Type</th> 
 <th>Required</th> 
 <th>Default</th> 
 <th>Description</th> 
 </tr> 
 </thead> 
 <tbody> 
 <tr> 
 <td><code>input</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td><code>REJECT</code></td> 
 <td>Set policy for the&nbsp;<code>INPUT</code>&nbsp;chain of the&nbsp;<code>filter</code>&nbsp;table.</td> 
 </tr> 
 <tr> 
 <td><code>forward</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td><code>REJECT</code></td> 
 <td>Set policy for the&nbsp;<code>FORWARD</code>&nbsp;chain of the&nbsp;<code>filter</code>&nbsp;table.</td> 
 </tr> 
 <tr> 
 <td><code>output</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td><code>REJECT</code></td> 
 <td>Set policy for the&nbsp;<code>OUTPUT</code>&nbsp;chain of the&nbsp;<code>filter</code>&nbsp;table.</td> 
 </tr> 
 <tr> 
 <td><code>drop_invalid</code></td> 
 <td>boolean</td> 
 <td>no</td> 
 <td><code>0</code></td> 
 <td>Drop invalid packets (e.g. not matching any active connection).</td> 
 </tr> 
 <tr> 
 <td><code>syn_flood</code></td> 
 <td>boolean</td> 
 <td>no</td> 
 <td><code>0</code></td> 
 <td>Enable&nbsp;<a href="https://en.wikipedia.org/wiki/SYN%20flood" rel="nofollow">SYN flood</a>&nbsp;protection (obsoleted by&nbsp;<code>synflood_protect</code>&nbsp;setting).</td> 
 </tr> 
 <tr> 
 <td><code>synflood_protect</code></td> 
 <td>boolean</td> 
 <td>no</td> 
 <td><code>0</code></td> 
 <td>Enable&nbsp;<a href="https://en.wikipedia.org/wiki/SYN%20flood" rel="nofollow">SYN flood</a>&nbsp;protection.</td> 
 </tr> 
 <tr> 
 <td><code>synflood_rate</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td><code>25</code></td> 
 <td>Set rate limit (packets/second) for SYN packets above which the traffic is considered a flood.</td> 
 </tr> 
 <tr> 
 <td><code>synflood_burst</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td><code>50</code></td> 
 <td>Set burst limit for SYN packets above which the traffic is considered a flood if it exceeds the allowed rate.</td> 
 </tr> 
 <tr> 
 <td><code>tcp_syncookies</code></td> 
 <td>boolean</td> 
 <td>no</td> 
 <td><code>1</code></td> 
 <td>Enable the use of&nbsp;<a href="https://en.wikipedia.org/wiki/SYN%20cookies" rel="nofollow">SYN cookies</a>.</td> 
 </tr> 
 <tr> 
 <td><code>tcp_ecn</code></td> 
 <td>boolean</td> 
 <td>no</td> 
 <td><code>0</code></td> 
 <td>Enable/Disable&nbsp;<a href="https://en.wikipedia.org/wiki/Explicit_Congestion_Notification" rel="nofollow">Explicit Congestion Notification</a>. Implemented upstream in Linux Kernel. See&nbsp;<a href="https://github.com/torvalds/linux/blob/54dee406374ce8adb352c48e175176247cb8db7c/Documentation/networking/ip-sysctl.txt" rel="nofollow">ip-sysctl.txt</a>.</td> 
 </tr> 
 <tr> 
 <td><code>tcp_window_scaling</code></td> 
 <td>boolean</td> 
 <td>no</td> 
 <td><code>1</code></td> 
 <td>Enable&nbsp;TCP&nbsp;window scaling.</td> 
 </tr> 
 <tr> 
 <td><code>accept_redirects</code></td> 
 <td>boolean</td> 
 <td>no</td> 
 <td><code>0</code></td> 
 <td>Accepts redirects. Implemented upstream in Linux Kernel. See&nbsp;<a href="https://github.com/torvalds/linux/blob/54dee406374ce8adb352c48e175176247cb8db7c/Documentation/networking/ip-sysctl.txt" rel="nofollow">ip-sysctl.txt</a>.</td> 
 </tr> 
 <tr> 
 <td><code>accept_source_route</code></td> 
 <td>boolean</td> 
 <td>no</td> 
 <td><code>0</code></td> 
 <td>Implemented upstream in Linux Kernel. See&nbsp;<a href="https://github.com/torvalds/linux/blob/54dee406374ce8adb352c48e175176247cb8db7c/Documentation/networking/ip-sysctl.txt" rel="nofollow">ip-sysctl.txt</a>.</td> 
 </tr> 
 <tr> 
 <td><code>custom_chains</code></td> 
 <td>boolean</td> 
 <td>no</td> 
 <td><code>1</code></td> 
 <td>Enable generation of custom rule chain hooks for user generated rules. User rules would be typically stored in firewall.user but some packages e.g. BCP38 also make use of these hooks.</td> 
 </tr> 
 <tr> 
 <td><code>disable_ipv6</code></td> 
 <td>boolean</td> 
 <td>no</td> 
 <td><code>0</code></td> 
 <td>Disable&nbsp;IPv6&nbsp;firewall rules.</td> 
 </tr> 
 <tr> 
 <td><code>flow_offloading</code></td> 
 <td>boolean</td> 
 <td>no</td> 
 <td><code>0</code></td> 
 <td>Enable software flow offloading for connections. (decrease cpu load / increase routing throughput)</td> 
 </tr> 
 <tr> 
 <td><code>flow_offloading_hw</code></td> 
 <td>boolean</td> 
 <td>no</td> 
 <td><code>0</code></td> 
 <td>Enable hardware flow offloading for connections. (depends on flow_offloading and hw capability)</td> 
 </tr> 
 <tr> 
 <td><code>tcp_reject_code</code></td> 
 <td>reject_code</td> 
 <td>no</td> 
 <td><code>0</code></td> 
 <td>Defined in&nbsp;<a href="https://lxr.openwrt.org/source/firewall3/options.h#L92" rel="nofollow">firewall3/options.h</a>. Seems to determine method of packet rejection; (<a href="https://en.wikipedia.org/wiki/TCP_reset_attack" rel="nofollow">tcp reset, or drop</a>, vs&nbsp;<a href="https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol#Destination_unreachable" rel="nofollow">ICMP Destination Unreachable, or closed</a>)</td> 
 </tr> 
 <tr> 
 <td><code>any_reject_code</code></td> 
 <td>reject_code</td> 
 <td>no</td> 
 <td><code>1</code></td> 
 <td>Defined in&nbsp;<a href="https://lxr.openwrt.org/source/firewall3/options.h#L92" rel="nofollow">firewall3/options.h</a>. Seems to determine method of packet rejection; (<a href="https://en.wikipedia.org/wiki/TCP_reset_attack" rel="nofollow">tcp reset, or drop</a>, vs&nbsp;<a href="https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol#Destination_unreachable" rel="nofollow">ICMP Destination Unreachable, or closed</a>)</td> 
 </tr> 
 <tr> 
 <td><code>auto-helper</code></td> 
 <td>bool</td> 
 <td>no</td> 
 <td><img alt="FIXME" src="/images/20211213/e53f4335f2764405be3fb654c0748937.png"></td> 
 <td><img alt="FIXME" src="/images/20211213/e53f4335f2764405be3fb654c0748937.png"></td> 
 </tr> 
 </tbody> 
</table>

### Includes ###

可以通过在防火墙配置中指定一个或多个包含部分来包含自定义的防火墙脚本：

`config include option path '/etc/firewall.user'`

*  脚本`/etc/firewall.user` 默认为空.

Options

包含的类型脚本可以包含任意命令，例如高级iptables规则或流量控制所需的tc命令。

*  ![:!:][aHR0cHM6Ly9vcGVud3J0Lm9yZy9saWIvaW1hZ2VzL3NtaWxleXMvaWNvbl9leGNsYWltLmdpZg] 由于自定义iptables规则比通用规则更具体，所以必须确保使用-I (insert)而不是-A (append)，这样自定义规则就会出现在默认规则之前。
 *  ![:!:][aHR0cHM6Ly9vcGVud3J0Lm9yZy9saWIvaW1hZ2VzL3NtaWxleXMvaWNvbl9leGNsYWltLmdpZg] 如果规则存在于iptables中，则不会重新添加它。标准的iptables -I或-A将添加一个重复的规则。

Example

以下是/etc/firewall.user脚本的示例，该脚本允许CloudFlare.com访问HTTP 80和HTTPS 443端口。 如果您的uhttpd隐藏在CF代理后面，请使用。

# Replace the ips-v4 with v6 if needed
    for ip in `wget -qO- http://www.cloudflare.com/ips-v4`; doo
      iptables -I INPUT -p tcp -m multiport --dports http,https -s $ip -j ACCEPT
    done

**NOTE:** 它使用HTTP获取ip列表，因为要通过https获取wget，我们需要安装ca-certs。这使您容易受到MiTM攻击，但这是可以让你免于互联网黑客的攻击。

### Redirects ###

端口转发（DNAT)在 redirect节被定义。端口重定向通常也称为端口转发或虚拟服务器。

*  与给定规则匹配的指定源区域上的所有传入流量将被定向到指定的内部主机。
 *  端口范围被指定为start:stop，例如6666:6670(类似于iptables语法)。

Destination NAT

config redirect
        option  target      'DNAT'
        option  proto       'tcp'
        option  src         'wan'
        option  src_dport   '19900'
        option  dest        'lan'
        option  dest_port   '22'
        option  dest_ip     '192.168.1.1'
        option  name        'Allow Redirect WAN -> LAN (SSH)'

![:!:][aHR0cHM6Ly9vcGVud3J0Lm9yZy9saWIvaW1hZ2VzL3NtaWxleXMvaWNvbl9leGNsYWltLmdpZg] 如果配置节中没有包含src\_dport，则在任意端口上与其他配置选项匹配的包将被转发到该配置节中指定的目标端口。这可能会对在config部分打开的目标端口上运行的应用程序造成安全风险。测试这个问题的一种方法是使用 *[Gibson Research Corporation][]*的ShieldsUP!服务，并探测路由器上所需的端口。 响应可以是打开，关闭或隐身（丢弃）。 在打开或关闭端口的情况下，数据包到达目标主机，并向后发送确认/回复数据包。隐藏的端口丢弃数据包； 从探测系统（Gibson Research）的角度来看，该系统无法确切地知道那些数据包是否到达目标主机。

Source NAT

Masquerade是最常见的SNAT形式，它将流量源从WAN更改为路由器的公共IP。SNAT也可以手工完成:

config redirect
        option  target      'SNAT'
        option  proto       'icmp'
        option  src         'dmz'
        option  src_ip      '192.168.1.250'
        option  src_dip     '1.2.3.4'
        option  dest        'wan'
        option  name        'SNAT: DMZ ICMP 192.168.1.250 -> 1.2.3.4'

Options

<table> 
 <thead> 
 <tr> 
 <th>Name</th> 
 <th>Type</th> 
 <th>Required</th> 
 <th>Default</th> 
 <th>Description</th> 
 </tr> 
 </thead> 
 <tbody> 
 <tr> 
 <td><code>name</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td>string</td> 
 <td>Name of redirect</td> 
 </tr> 
 <tr> 
 <td><code>src</code></td> 
 <td>zone name</td> 
 <td>yes for&nbsp;<code>DNAT</code>target</td> 
 <td>(none)</td> 
 <td>Specifies the traffic&nbsp;source zone. Must refer to one of the defined&nbsp;zone names. For typical port forwards this usually is&nbsp;<code>wan</code>.</td> 
 </tr> 
 <tr> 
 <td><code>src_ip</code></td> 
 <td>ip address</td> 
 <td>no</td> 
 <td>(none)</td> 
 <td>Match incoming traffic from the specified&nbsp;source ip address.</td> 
 </tr> 
 <tr> 
 <td><code>src_dip</code></td> 
 <td>ip address</td> 
 <td>yes for&nbsp;<code>SNAT</code>target</td> 
 <td>(none)</td> 
 <td>For&nbsp;DNAT, match incoming traffic directed at the given&nbsp;destination ip address. For&nbsp;SNAT&nbsp;rewrite the&nbsp;source address&nbsp;to the given address.</td> 
 </tr> 
 <tr> 
 <td><code>src_mac</code></td> 
 <td>mac address</td> 
 <td>no</td> 
 <td>(none)</td> 
 <td>Match incoming traffic from the specified&nbsp;mac address.</td> 
 </tr> 
 <tr> 
 <td><code>src_port</code></td> 
 <td>port or range</td> 
 <td>no</td> 
 <td>(none)</td> 
 <td>Match incoming traffic originating from the given&nbsp;source port or port range&nbsp;on the client host.</td> 
 </tr> 
 <tr> 
 <td><code>src_dport</code></td> 
 <td>port or range</td> 
 <td>no</td> 
 <td>(none)</td> 
 <td>For&nbsp;DNAT, match incoming traffic directed at the given&nbsp;destination port or port range&nbsp;on this host. For&nbsp;SNATrewrite the&nbsp;source ports&nbsp;to the given value.</td> 
 </tr> 
 <tr> 
 <td><code>proto</code></td> 
 <td>protocol name or number</td> 
 <td>no</td> 
 <td>tcpudp</td> 
 <td>Match incoming traffic using the given&nbsp;protocol.</td> 
 </tr> 
 <tr> 
 <td><code>dest</code></td> 
 <td>zone name</td> 
 <td>yes for&nbsp;<code>SNAT</code>target</td> 
 <td>(none)</td> 
 <td>Specifies the traffic&nbsp;destination zone. Must refer to one of the defined&nbsp;zone names. For&nbsp;<code>DNAT</code>&nbsp;target on Attitude Adjustment,&nbsp;NAT&nbsp;reflection works only if this is equal to&nbsp;<code>lan</code>.</td> 
 </tr> 
 <tr> 
 <td><code>dest_ip</code></td> 
 <td>ip address</td> 
 <td>yes for&nbsp;<code>DNAT</code>target</td> 
 <td>(none)</td> 
 <td>For&nbsp;DNAT, redirect matched incoming traffic to the specified internal host. For&nbsp;SNAT, match traffic directed at the given address. For&nbsp;DNAT&nbsp;if the&nbsp;<code>dest_ip</code>&nbsp;value matches the local ip addresses of the router, as shown in the&nbsp;<code>ifconfig</code>, then the rule is translated in a DNAT + input 'accept' rule. Otherwise it is a DNAT + forward rule.</td> 
 </tr> 
 <tr> 
 <td><code>dest_port</code></td> 
 <td>port or range</td> 
 <td>no</td> 
 <td>(none)</td> 
 <td>For&nbsp;DNAT, redirect matched incoming traffic to the given port on the internal host. For&nbsp;SNAT, match traffic directed at the given ports. Only a single port or range can be specified, not disparate ports as with Rules (below).</td> 
 </tr> 
 <tr> 
 <td><code>ipset</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td>(none)</td> 
 <td>If specified, match traffic against the given&nbsp;<a href="https://openwrt.org/docs/guide-user/firewall/firewall_configuration#ipsets" rel="nofollow">ipset</a>. The match can be inverted by prefixing the value with an exclamation mark.</td> 
 </tr> 
 <tr> 
 <td><code>mark</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td>(none)</td> 
 <td>If specified, match traffic against the given firewall mark, e.g.&nbsp;<code>0xFF</code>&nbsp;to match mark 255 or&nbsp;<code>0x0/0x1</code>&nbsp;to match any even mark value. The match can be inverted by prefixing the value with an exclamation mark, e.g.&nbsp;<code>!0x10</code>to match all but mark #16.</td> 
 </tr> 
 <tr> 
 <td><code>start_date</code></td> 
 <td>date (<code>yyyy-mm-dd</code>)</td> 
 <td>no</td> 
 <td>(always)</td> 
 <td>If specifed, only match traffic after the given date (inclusive).</td> 
 </tr> 
 <tr> 
 <td><code>stop_date</code></td> 
 <td>date (<code>yyyy-mm-dd</code>)</td> 
 <td>no</td> 
 <td>(always)</td> 
 <td>If specified, only match traffic before the given date (inclusive).</td> 
 </tr> 
 <tr> 
 <td><code>start_time</code></td> 
 <td>time (<code>hh:mm:ss</code>)</td> 
 <td>no</td> 
 <td>(always)</td> 
 <td>If specified, only match traffic after the given time of day (inclusive).</td> 
 </tr> 
 <tr> 
 <td><code>stop_time</code></td> 
 <td>time (<code>hh:mm:ss</code>)</td> 
 <td>no</td> 
 <td>(always)</td> 
 <td>If specified, only match traffic before the given time of day (inclusive).</td> 
 </tr> 
 <tr> 
 <td><code>weekdays</code></td> 
 <td>list of weekdays</td> 
 <td>no</td> 
 <td>(always)</td> 
 <td>If specified, only match traffic during the given week days, e.g.&nbsp;<code>sun mon thu fri</code>&nbsp;to only match on Sundays, Mondays, Thursdays and Fridays. The list can be inverted by prefixing it with an exclamation mark, e.g.&nbsp;<code>! sat sun</code>&nbsp;to always match but on Saturdays and sundays.</td> 
 </tr> 
 <tr> 
 <td><code>monthdays</code></td> 
 <td>list of dates</td> 
 <td>no</td> 
 <td>(always)</td> 
 <td>If specified, only match traffic during the given days of the month, e.g.&nbsp;<code>2 5 30</code>&nbsp;to only match on every 2nd, 5th and 30rd day of the month. The list can be inverted by prefixing it with an exclamation mark, e.g.&nbsp;<code>! 31</code>&nbsp;to always match but on the 31st of the month.</td> 
 </tr> 
 <tr> 
 <td><code>utc_time</code></td> 
 <td>boolean</td> 
 <td>no</td> 
 <td><code>0</code></td> 
 <td>Treat all given time values as UTC time instead of local time.</td> 
 </tr> 
 <tr> 
 <td><code>target</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td><code>DNAT</code></td> 
 <td>NAT&nbsp;target (<code>DNAT</code>&nbsp;or&nbsp;<code>SNAT</code>) to use when generating the rule.</td> 
 </tr> 
 <tr> 
 <td><code>family</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td><code>any</code></td> 
 <td>Protocol family (<code>ipv4</code>,&nbsp;<code>ipv6</code>&nbsp;or&nbsp;<code>any</code>) to generate iptables rules for.</td> 
 </tr> 
 <tr> 
 <td><code>reflection</code></td> 
 <td>boolean</td> 
 <td>no</td> 
 <td><code>1</code></td> 
 <td>Activate&nbsp;NAT&nbsp;reflection for this redirect - applicable to&nbsp;<code>DNAT</code>&nbsp;targets.</td> 
 </tr> 
 <tr> 
 <td><code>reflection_src</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td><code>internal</code></td> 
 <td>The source address to use for&nbsp;NAT-reflected packets if&nbsp;<code>reflection</code>&nbsp;is&nbsp;<code>1</code>. This can be&nbsp;<code>internal</code>&nbsp;or&nbsp;<code>external</code>, specifying which interface’s address to use. Applicable to&nbsp;<code>DNAT</code>&nbsp;targets.</td> 
 </tr> 
 <tr> 
 <td><code>limit</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td>(none)</td> 
 <td>Maximum average matching rate; specified as a number, with an optional&nbsp;<code>/second</code>,&nbsp;<code>/minute</code>,&nbsp;<code>/hour</code>&nbsp;or&nbsp;<code>/day</code>suffix. Examples:&nbsp;<code>3/second</code>,&nbsp;<code>3/sec</code>&nbsp;or&nbsp;<code>3/s</code>.</td> 
 </tr> 
 <tr> 
 <td><code>limit_burst</code></td> 
 <td>integer</td> 
 <td>no</td> 
 <td><code>5</code></td> 
 <td>Maximum initial number of packets to match, allowing a short-term average above&nbsp;<code>limit</code>.</td> 
 </tr> 
 <tr> 
 <td><code>enabled</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td><code>1</code>&nbsp;or&nbsp;<code>yes</code></td> 
 <td>Enable the redirect rule or not.</td> 
 </tr> 
 <tr> 
 <td><code>helper</code></td> 
 <td>cthelper</td> 
 <td>no</td> 
 <td><img alt="FIXME" src="/images/20211213/e53f4335f2764405be3fb654c0748937.png"></td> 
 <td><img alt="FIXME" src="/images/20211213/e53f4335f2764405be3fb654c0748937.png"></td> 
 </tr> 
 </tbody> 
</table>

### Zones ###

A `zone` section groups one or more *interfaces* and serves as a *source* or *destination* for *forwardings*, *rules* and *redirects*.

config zone
        option  name        'wan'
        option  network     'wan wan6'
        option  input       'REJECT'
        option  output      'ACCEPT'
        option  forward     'REJECT'
        option  masq        '1'
        option  mtu_fix     '1'

*  **MASQUERADE** (NAT) of outgoing traffic (WAN) is controlled on a per-zone basis on the *outgoing* interface.  
     
 *  **INPUT** rules for a zone describe what happens to traffic trying to reach the router itself through an interface in that zone.
 *  **OUTPUT** rules for a zone describe what happens to traffic originating from the router itself going through an interface in that zone.
 *  **FORWARD** rules for a zone describe what happens to traffic passing between different interfaces belonging in the same zone.

Options

<table> 
 <thead> 
 <tr> 
 <th>Name</th> 
 <th>Type</th> 
 <th>Required</th> 
 <th>Default</th> 
 <th>Description</th> 
 </tr> 
 </thead> 
 <tbody> 
 <tr> 
 <td><code>name</code></td> 
 <td>zone name</td> 
 <td>yes</td> 
 <td>(none)</td> 
 <td>Unique zone name. 11 characters is the maximum working firewall zone name length.</td> 
 </tr> 
 <tr> 
 <td><code>network</code></td> 
 <td>list</td> 
 <td>no</td> 
 <td>(none)</td> 
 <td>List of&nbsp;<a href="https://openwrt.org/docs/guide-user/base-system/basic-networking#interfaces" rel="nofollow">interfaces</a>&nbsp;attached to this zone. If omitted and neither extra* options, subnets nor devices are given, the value of&nbsp;<code>name</code>&nbsp;is used by default. Alias interfaces defined in the network config cannot be used as valid 'standalone' networks. Use&nbsp;<a href="https://openwrt.org/docs/guide-user/base-system/basic#appending_or_deleting_values_on_a_list_option" rel="nofollow">list syntax</a>&nbsp;.</td> 
 </tr> 
 <tr> 
 <td><code>masq</code></td> 
 <td>boolean</td> 
 <td>no</td> 
 <td><code>0</code></td> 
 <td>Specifies whether&nbsp;outgoing&nbsp;zone traffic should be masqueraded. This is typically enabled on the&nbsp;wan&nbsp;zone.</td> 
 </tr> 
 <tr> 
 <td><code>masq_src</code></td> 
 <td>list of subnets</td> 
 <td>no</td> 
 <td><code>0.0.0.0/0</code></td> 
 <td>Limit masquerading to the given source subnets. Negation is possible by prefixing the subnet with&nbsp;<code>!</code>; multiple subnets are allowed.</td> 
 </tr> 
 <tr> 
 <td><code>masq_dest</code></td> 
 <td>list of subnets</td> 
 <td>no</td> 
 <td><code>0.0.0.0/0</code></td> 
 <td>Limit masquerading to the given destination subnets. Negation is possible by prefixing the subnet with&nbsp;<code>!</code>; multiple subnets are allowed.</td> 
 </tr> 
 <tr> 
 <td><code>masq_allow_invalid</code></td> 
 <td>boolean</td> 
 <td>no</td> 
 <td><code>0</code></td> 
 <td>Do not add&nbsp;<code>DROP INVALID</code>&nbsp;rules, if masquerading is used. The&nbsp;<code>DROP</code>&nbsp;rules are supposed to prevent&nbsp;NATleakage (see&nbsp;<a href="https://git.lede-project.org/?p=project/firewall3.git;a=commit;h=e751cde8954a09ea32f67a8bf7974b4dc1395f2e" rel="nofollow">commit in firewall3</a>).</td> 
 </tr> 
 <tr> 
 <td><code>mtu_fix</code></td> 
 <td>boolean</td> 
 <td>no</td> 
 <td><code>0</code></td> 
 <td>Enable MSS clamping for&nbsp;outgoing&nbsp;zone traffic.</td> 
 </tr> 
 <tr> 
 <td><code>input</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td><code>DROP</code></td> 
 <td>Default policy (<code>ACCEPT</code>,&nbsp;<code>REJECT</code>,&nbsp;<code>DROP</code>) for&nbsp;incoming&nbsp;zone traffic.</td> 
 </tr> 
 <tr> 
 <td><code>forward</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td><code>DROP</code></td> 
 <td>Default policy (<code>ACCEPT</code>,&nbsp;<code>REJECT</code>,&nbsp;<code>DROP</code>) for&nbsp;forwarded&nbsp;zone traffic.</td> 
 </tr> 
 <tr> 
 <td><code>output</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td><code>DROP</code></td> 
 <td>Default policy (<code>ACCEPT</code>,&nbsp;<code>REJECT</code>,&nbsp;<code>DROP</code>) for&nbsp;outgoing&nbsp;zone traffic.</td> 
 </tr> 
 <tr> 
 <td><code>family</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td><code>any</code></td> 
 <td>The protocol family (<code>ipv4</code>,&nbsp;<code>ipv6</code>&nbsp;or&nbsp;<code>any</code>) these iptables rules are for.</td> 
 </tr> 
 <tr> 
 <td><code>log</code></td> 
 <td>int</td> 
 <td>no</td> 
 <td><code>0</code></td> 
 <td>Bit field to enable logging in the filter and/or mangle tables, bit 0 = filter, bit 1 = mangle. (Since r6397-7cc9914aae)</td> 
 </tr> 
 <tr> 
 <td><code>log_limit</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td><code>10/minute</code></td> 
 <td>Limits the amount of log messages per interval.</td> 
 </tr> 
 <tr> 
 <td><code>device</code></td> 
 <td>list</td> 
 <td>no</td> 
 <td>(none)</td> 
 <td>List of raw network device names attached to this zone, e.g.&nbsp;<code>ppp+</code>&nbsp;to match any PPP interface.</td> 
 </tr> 
 <tr> 
 <td><code>subnet</code></td> 
 <td>list</td> 
 <td>no</td> 
 <td>(none)</td> 
 <td>List of&nbsp;IP&nbsp;subnets attached to this zone.</td> 
 </tr> 
 <tr> 
 <td><code>extra</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td>(none)</td> 
 <td>Extra arguments passed directly to iptables. Note that these options are passed to both source and destination classification rules, therefor direction-specific options like&nbsp;<code>--dport</code>&nbsp;should not be used here - in this case the&nbsp;<code>extra_src</code>&nbsp;and&nbsp;<code>extra_dest</code>&nbsp;options should be used instead.</td> 
 </tr> 
 <tr> 
 <td><code>extra_src</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td>Value of&nbsp;<code>extra</code></td> 
 <td>Extra arguments passed directly to iptables for source classification rules.</td> 
 </tr> 
 <tr> 
 <td><code>extra_dest</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td>Value of&nbsp;<code>extra</code></td> 
 <td>Extra arguments passed directly to iptables for destination classification rules.</td> 
 </tr> 
 <tr> 
 <td><code>custom-chains</code></td> 
 <td>bool</td> 
 <td>no</td> 
 <td><img alt="FIXME" src="/images/20211213/e53f4335f2764405be3fb654c0748937.png"></td> 
 <td><img alt="FIXME" src="/images/20211213/e53f4335f2764405be3fb654c0748937.png"></td> 
 </tr> 
 <tr> 
 <td><code>enabled</code></td> 
 <td>bool</td> 
 <td>no</td> 
 <td>yes</td> 
 <td>if set to&nbsp;<code>0</code>, zone is disabled</td> 
 </tr> 
 <tr> 
 <td><code>auto_helper</code></td> 
 <td>bool</td> 
 <td>no</td> 
 <td><img alt="FIXME" src="/images/20211213/e53f4335f2764405be3fb654c0748937.png"></td> 
 <td><img alt="FIXME" src="/images/20211213/e53f4335f2764405be3fb654c0748937.png"></td> 
 </tr> 
 <tr> 
 <td><code>helper</code></td> 
 <td>cthelper</td> 
 <td>no</td> 
 <td><img alt="FIXME" src="/images/20211213/e53f4335f2764405be3fb654c0748937.png"></td> 
 <td><img alt="FIXME" src="/images/20211213/e53f4335f2764405be3fb654c0748937.png"></td> 
 </tr> 
 </tbody> 
</table>

### Forwardings ###

The `forwarding` sections control the traffic flow between *zones*, and may enable [MSS clamping][] for specific directions.

config forwarding
        option  src         'lan'
        option  dest        'wan'

*  Only one direction is covered by a `forwarding` rule. To allow bidirectional traffic flows between two *zones*, two *forwardings* are required, with `src` and `dest` reversed in each.

Options

![:!:][aHR0cHM6Ly9vcGVud3J0Lm9yZy9saWIvaW1hZ2VzL3NtaWxleXMvaWNvbl9leGNsYWltLmdpZg] The *iptables* rules generated for this section rely on the *state match* which needs connection tracking to work.

*  At least one of the `src` or `dest` zones needs to have *connection tracking* enabled through the `masq` option.

### Rules ###

The `rule` section is used to define basic accept, drop, or reject rules to allow or restrict access to specific ports or hosts.

config rule
        option  target      'REJECT'
        option  proto       'tcp'
        option  src         'lan'
        option  src_ip      '192.168.1.2'
        option  src_mac     '00:11:22:33:44:55'
        option  src_port    '80'
        option  dest        'wan'
        option  dest_ip     '194.25.2.129'
        option  dest_port   '120'

*  In [fw3][], the `src` and `dest` are tied to the target:
    
     *  If `src` and `dest` are given, the rule matches *forwarded* traffic
     *  If only `src` is given, the rule matches *incoming* traffic
     *  If only `dest` is given, the rule matches *outgoing* traffic
     *  If neither `src` nor `dest` are given, the rule defaults to an *outgoing* traffic rule  
         
 *  Port ranges are specified as `start:stop`, for instance `6666:6670` *(similar to the iptables syntax)*.

Options

<table> 
 <thead> 
 <tr> 
 <th>Name</th> 
 <th>Type</th> 
 <th>Required</th> 
 <th>Default</th> 
 <th>Description</th> 
 </tr> 
 </thead> 
 <tbody> 
 <tr> 
 <td><code>name</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td>(none)</td> 
 <td>Name of rule</td> 
 </tr> 
 <tr> 
 <td><code>src</code></td> 
 <td>zone name</td> 
 <td>yes (<img alt=":!:" src="/images/20211213/003c592a04124e57861372b0fa050752.png">&nbsp;optional since Firewall v2, version 58 and above)</td> 
 <td>(none)</td> 
 <td>Specifies the traffic&nbsp;source zone. Must refer to one of the defined&nbsp;zone names.</td> 
 </tr> 
 <tr> 
 <td><code>src_ip</code></td> 
 <td>ip address</td> 
 <td>no</td> 
 <td>(none)</td> 
 <td>Match incoming traffic from the specified&nbsp;source ip address</td> 
 </tr> 
 <tr> 
 <td><code>src_mac</code></td> 
 <td>mac address</td> 
 <td>no</td> 
 <td>(none)</td> 
 <td>Match incoming traffic from the specified&nbsp;mac address</td> 
 </tr> 
 <tr> 
 <td><code>src_port</code></td> 
 <td>port or range</td> 
 <td>no</td> 
 <td>(none)</td> 
 <td>Match incoming traffic from the specified&nbsp;source port&nbsp;or&nbsp;port range, if relevant&nbsp;<code>proto</code>&nbsp;is specified. Multiple ports can be specified like '80 443 465'&nbsp;<a href="https://forum.openwrt.org/viewtopic.php?pid=287271" rel="nofollow">1</a>.</td> 
 </tr> 
 <tr> 
 <td><code>proto</code></td> 
 <td>protocol name or number</td> 
 <td>no</td> 
 <td><code>tcpudp</code></td> 
 <td>Match incoming traffic using the given&nbsp;protocol. Can be one of&nbsp;<code>tcp</code>,&nbsp;<code>udp</code>,&nbsp;<code>tcpudp</code>,&nbsp;<code>udplite</code>,&nbsp;<code>icmp</code>,&nbsp;<code>esp</code>,&nbsp;<code>ah</code>,&nbsp;<code>sctp</code>, or&nbsp;<code>all</code>&nbsp;or it can be a numeric value, representing one of these protocols or a different one. A protocol name from&nbsp;<code>/etc/protocols</code>&nbsp;is also allowed. The number 0 is equivalent to&nbsp;<code>all</code>.</td> 
 </tr> 
 <tr> 
 <td><code>icmp_type</code></td> 
 <td>list of type names or numbers</td> 
 <td>no</td> 
 <td>any</td> 
 <td>For&nbsp;protocol&nbsp;<code>icmp</code>&nbsp;select specific icmp types to match. Values can be either exact icmp type numbers or type names (see below).</td> 
 </tr> 
 <tr> 
 <td><code>dest</code></td> 
 <td>zone name</td> 
 <td>no</td> 
 <td>(none)</td> 
 <td>Specifies the traffic&nbsp;destination zone. Must refer to one of the defined&nbsp;zone names, or * for any zone. If specified, the rule applies to&nbsp;forwarded&nbsp;traffic; otherwise, it is treated as&nbsp;input&nbsp;rule.</td> 
 </tr> 
 <tr> 
 <td><code>dest_ip</code></td> 
 <td>ip address</td> 
 <td>no</td> 
 <td>(none)</td> 
 <td>Match incoming traffic directed to the specified&nbsp;destination ip address. With no dest zone, this is treated as an input rule!</td> 
 </tr> 
 <tr> 
 <td><code>dest_port</code></td> 
 <td>port or range</td> 
 <td>no</td> 
 <td>(none)</td> 
 <td>Match incoming traffic directed at the given&nbsp;destination port or port range, if relevant&nbsp;<code>proto</code>&nbsp;is specified. Multiple ports can be specified like '80 443 465'&nbsp;<a href="https://forum.openwrt.org/viewtopic.php?pid=287271" rel="nofollow">1</a>.</td> 
 </tr> 
 <tr> 
 <td><code>ipset</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td>(none)</td> 
 <td>If specified, match traffic against the given&nbsp;<a href="https://openwrt.org/docs/guide-user/firewall/firewall_configuration#ipsets" rel="nofollow">ipset</a>. The match can be inverted by prefixing the value with an exclamation mark. You can specify the direction as 'setname src' or 'setname dest'.</td> 
 </tr> 
 <tr> 
 <td><code>mark</code></td> 
 <td>mark/mask</td> 
 <td>no</td> 
 <td>(none)</td> 
 <td>If specified, match traffic against the given firewall mark, e.g.&nbsp;<code>0xFF</code>&nbsp;to match mark 255 or&nbsp;<code>0x0/0x1</code>&nbsp;to match any even mark value. The match can be inverted by prefixing the value with an exclamation mark, e.g.&nbsp;<code>!0x10</code>&nbsp;to match all but mark #16.</td> 
 </tr> 
 <tr> 
 <td><code>start_date</code></td> 
 <td>date (<code>yyyy-mm-dd</code>)</td> 
 <td>no</td> 
 <td>(always)</td> 
 <td>If specifed, only match traffic after the given date (inclusive).</td> 
 </tr> 
 <tr> 
 <td><code>stop_date</code></td> 
 <td>date (<code>yyyy-mm-dd</code>)</td> 
 <td>no</td> 
 <td>(always)</td> 
 <td>If specified, only match traffic before the given date (inclusive).</td> 
 </tr> 
 <tr> 
 <td><code>start_time</code></td> 
 <td>time (<code>hh:mm:ss</code>)</td> 
 <td>no</td> 
 <td>(always)</td> 
 <td>If specified, only match traffic after the given time of day (inclusive).</td> 
 </tr> 
 <tr> 
 <td><code>stop_time</code></td> 
 <td>time (<code>hh:mm:ss</code>)</td> 
 <td>no</td> 
 <td>(always)</td> 
 <td>If specified, only match traffic before the given time of day (inclusive).</td> 
 </tr> 
 <tr> 
 <td><code>weekdays</code></td> 
 <td>list of weekdays</td> 
 <td>no</td> 
 <td>(always)</td> 
 <td>If specified, only match traffic during the given week days, e.g.&nbsp;<code>sun mon thu fri</code>&nbsp;to only match on sundays, mondays, thursdays and Fridays. The list can be inverted by prefixing it with an exclamation mark, e.g.&nbsp;<code>! sat sun</code>&nbsp;to always match but on Saturdays and sundays.</td> 
 </tr> 
 <tr> 
 <td><code>monthdays</code></td> 
 <td>list of dates</td> 
 <td>no</td> 
 <td>(always)</td> 
 <td>If specified, only match traffic during the given days of the month, e.g.&nbsp;<code>2 5 30</code>&nbsp;to only match on every 2nd, 5th and 30rd day of the month. The list can be inverted by prefixing it with an exclamation mark, e.g.&nbsp;<code>! 31</code>&nbsp;to always match but on the 31st of the month.</td> 
 </tr> 
 <tr> 
 <td><code>utc_time</code></td> 
 <td>boolean</td> 
 <td>no</td> 
 <td><code>0</code></td> 
 <td>Treat all given time values as UTC time instead of local time.</td> 
 </tr> 
 <tr> 
 <td><code>target</code></td> 
 <td>string</td> 
 <td>yes</td> 
 <td><code>DROP</code></td> 
 <td>Firewall action (<code>ACCEPT</code>,&nbsp;<code>REJECT</code>,&nbsp;<code>DROP</code>,&nbsp;<code>MARK</code>,&nbsp;<code>NOTRACK</code>) for matched traffic</td> 
 </tr> 
 <tr> 
 <td><code>set_mark</code></td> 
 <td>mark/mask</td> 
 <td>yes for target&nbsp;<code>MARK</code></td> 
 <td>(none)</td> 
 <td>Zeroes out the bits given by mask and ORs value into the packet mark. If mask is omitted, 0xFFFFFFFF is assumed</td> 
 </tr> 
 <tr> 
 <td><code>set_xmark</code></td> 
 <td>Zeroes out the bits given by mask and XORs value into the packet mark. If mask is omitted, 0xFFFFFFFF is assumed</td> 
 </tr> 
 <tr> 
 <td><code>family</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td><code>any</code></td> 
 <td>Protocol family (<code>ipv4</code>,&nbsp;<code>ipv6</code>&nbsp;or&nbsp;<code>any</code>) to generate iptables rules for.</td> 
 </tr> 
 <tr> 
 <td><code>limit</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td>(none)</td> 
 <td>Maximum average matching rate; specified as a number, with an optional&nbsp;<code>/second</code>,&nbsp;<code>/minute</code>,&nbsp;<code>/hour</code>&nbsp;or&nbsp;<code>/day</code>&nbsp;suffix. Examples:&nbsp;<code>3/minute</code>,&nbsp;<code>3/min</code>&nbsp;or&nbsp;<code>3/m</code>.</td> 
 </tr> 
 <tr> 
 <td><code>limit_burst</code></td> 
 <td>integer</td> 
 <td>no</td> 
 <td><code>5</code></td> 
 <td>Maximum initial number of packets to match, allowing a short-term average above&nbsp;<code>limit</code></td> 
 </tr> 
 <tr> 
 <td><code>extra</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td>(none)</td> 
 <td>Extra arguments to pass to iptables. Useful mainly to specify additional match options, such as&nbsp;<code>-m policy --dir in</code>&nbsp;for IPsec.</td> 
 </tr> 
 <tr> 
 <td><code>enabled</code></td> 
 <td>boolean</td> 
 <td>no</td> 
 <td>yes</td> 
 <td>Enable or disable rule.</td> 
 </tr> 
 <tr> 
 <td><code>device</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td><img alt="FIXME" src="/images/20211213/e53f4335f2764405be3fb654c0748937.png"></td> 
 <td><img alt="FIXME" src="/images/20211213/e53f4335f2764405be3fb654c0748937.png"></td> 
 </tr> 
 <tr> 
 <td><code>direction</code></td> 
 <td>direction</td> 
 <td>no</td> 
 <td><img alt="FIXME" src="/images/20211213/e53f4335f2764405be3fb654c0748937.png"></td> 
 <td><img alt="FIXME" src="/images/20211213/e53f4335f2764405be3fb654c0748937.png">&nbsp;direction_out</td> 
 </tr> 
 <tr> 
 <td><code>set_helper</code></td> 
 <td>cthelper</td> 
 <td>no</td> 
 <td><img alt="FIXME" src="/images/20211213/e53f4335f2764405be3fb654c0748937.png"></td> 
 <td><img alt="FIXME" src="/images/20211213/e53f4335f2764405be3fb654c0748937.png"></td> 
 </tr> 
 <tr> 
 <td><code>helper</code></td> 
 <td>cthelper</td> 
 <td>no</td> 
 <td><img alt="FIXME" src="/images/20211213/e53f4335f2764405be3fb654c0748937.png"></td> 
 <td><img alt="FIXME" src="/images/20211213/e53f4335f2764405be3fb654c0748937.png"></td> 
 </tr> 
 </tbody> 
</table>

ICMP Name Types

<table> 
 <tbody> 
 <tr> 
 <td><code>address-mask-reply</code></td> 
 <td><code>host-redirect</code></td> 
 <td><code>pong</code></td> 
 <td><code>time-exceeded</code></td> 
 </tr> 
 <tr> 
 <td><code>address-mask-request</code></td> 
 <td><code>host-unknown</code></td> 
 <td><code>port-unreachable</code></td> 
 <td><code>timestamp-reply</code></td> 
 </tr> 
 <tr> 
 <td><code>any</code></td> 
 <td><code>host-unreachable</code></td> 
 <td><code>precedence-cutoff</code></td> 
 <td><code>timestamp-request</code></td> 
 </tr> 
 <tr> 
 <td><code>communication-prohibited</code></td> 
 <td><code>ip-header-bad</code></td> 
 <td><code>protocol-unreachable</code></td> 
 <td><code>TOS-host-redirect</code></td> 
 </tr> 
 <tr> 
 <td><code>destination-unreachable</code></td> 
 <td><code>network-prohibited</code></td> 
 <td><code>redirect</code></td> 
 <td><code>TOS-host-unreachable</code></td> 
 </tr> 
 <tr> 
 <td><code>echo-reply</code></td> 
 <td><code>network-redirect</code></td> 
 <td><code>required-option-missing</code></td> 
 <td><code>TOS-network-redirect</code></td> 
 </tr> 
 <tr> 
 <td><code>echo-request</code></td> 
 <td><code>network-unknown</code></td> 
 <td><code>router-advertisement</code></td> 
 <td><code>TOS-network-unreachable</code></td> 
 </tr> 
 <tr> 
 <td><code>fragmentation-needed</code></td> 
 <td><code>network-unreachable</code></td> 
 <td><code>router-solicitation</code></td> 
 <td><code>ttl-exceeded</code></td> 
 </tr> 
 <tr> 
 <td><code>host-precedence-violation</code></td> 
 <td><code>parameter-problem</code></td> 
 <td><code>source-quench</code></td> 
 <td><code>ttl-zero-during-reassembly</code></td> 
 </tr> 
 <tr> 
 <td><code>host-prohibited</code></td> 
 <td><code>ping</code></td> 
 <td><code>source-route-failed</code></td> 
 <td><code>ttl-zero-during-transit</code></td> 
 </tr> 
 </tbody> 
</table>

## Routing ##

### IP Sets ###

fw3 supports referencing or creating [ipsets][] to simplify matching of large address or port lists without the need for creating one rule per item to match.

*  ![:!:][aHR0cHM6Ly9vcGVud3J0Lm9yZy9saWIvaW1hZ2VzL3NtaWxleXMvaWNvbl9leGNsYWltLmdpZg] This needs the `kmod-ipt-ipset` kernel module installed.

Options

<table> 
 <thead> 
 <tr> 
 <th>Name</th> 
 <th>Type</th> 
 <th>Required</th> 
 <th>Default</th> 
 <th>Description</th> 
 </tr> 
 </thead> 
 <tbody> 
 <tr> 
 <td><code>enabled</code></td> 
 <td>boolean</td> 
 <td>no</td> 
 <td><code>1</code></td> 
 <td>Allows to disable the declaration of the ipset without the need to delete the section.</td> 
 </tr> 
 <tr> 
 <td><code>external</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td>(none)</td> 
 <td>If the&nbsp;<code>external</code>&nbsp;option is set to a name, the firewall will simply reference an already existing ipset pointed to by the name. If the&nbsp;<code>external</code>&nbsp;option is unset, the firewall will create the ipset on start and destroy it on stop.</td> 
 </tr> 
 <tr> 
 <td><code>name</code></td> 
 <td>string</td> 
 <td>yes if&nbsp;<code>external</code>is unset&nbsp; no if&nbsp;<code>external</code>is set</td> 
 <td>(none)&nbsp;if&nbsp;<code>external</code>is unset&nbsp; value of&nbsp;<code>external</code>if&nbsp;<code>external</code>is set</td> 
 <td>Specifies the firewall internal name of the ipset which is used to reference the set in rules or redirects.</td> 
 </tr> 
 <tr> 
 <td><code>family</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td><code>ipv4</code></td> 
 <td>Protocol family (<code>ipv4</code>&nbsp;or&nbsp;<code>ipv6</code>) to create ipset for. Only applicable to storage types&nbsp;<code>hash</code>&nbsp;and&nbsp;<code>list</code>, the&nbsp;<code>bitmap</code>&nbsp;type implies&nbsp;<code>ipv4</code>.</td> 
 </tr> 
 <tr> 
 <td><code>storage</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td>varies</td> 
 <td>Specifies the storage method (<code>bitmap</code>,&nbsp;<code>hash</code>&nbsp;or&nbsp;<code>list</code>) used by the ipset, the default varies depending on the used datatypes (see&nbsp;<code>match</code>&nbsp;option below). In most cases the storage method can be automatically inferred from the datatype combination but in some cases multiple choices are possible (e.g.&nbsp;<code>bitmap:ip</code>&nbsp;vs.&nbsp;<code>hash:ip</code>).</td> 
 </tr> 
 <tr> 
 <td><code>match</code></td> 
 <td>list of direction/type tuples</td> 
 <td>yes</td> 
 <td>(none)</td> 
 <td>Specifies the matched data types (<code>ip</code>,&nbsp;<code>port</code>,&nbsp;<code>mac</code>,&nbsp;<code>net</code>&nbsp;or&nbsp;<code>set</code>) and their direction (<code>src</code>&nbsp;or&nbsp;<code>dest</code>). The direction is joined with the datatype by an underscore to form a tuple, e.g.&nbsp;<code>src_port</code>&nbsp;to match source ports or&nbsp;<code>dest_net</code>&nbsp;to match destination CIDR ranges. When using ipsets matching on multiple elements, e.g.&nbsp;<code>hash:ip,port</code>, specify the packet fields to match on in quotes or comma-separated (i.e. “match dest_ip dest_port”).</td> 
 </tr> 
 <tr> 
 <td><code>iprange</code></td> 
 <td>IP&nbsp;range</td> 
 <td>yes for storage type&nbsp;<code>bitmap</code>with datatype&nbsp;<code>ip</code></td> 
 <td>(none)</td> 
 <td>Specifies the&nbsp;IP&nbsp;range to cover, see&nbsp;<a href="http://ipset.netfilter.org/ipset.man.html" rel="nofollow">ipset(8)</a>. Only applicable to the&nbsp;<code>hash</code>&nbsp;storage type.</td> 
 </tr> 
 <tr> 
 <td><code>portrange</code></td> 
 <td>Port range</td> 
 <td>yes for storage type&nbsp;<code>bitmap</code>with datatype&nbsp;<code>port</code></td> 
 <td>(none)</td> 
 <td>Specifies the port range to cover, see&nbsp;<a href="http://ipset.netfilter.org/ipset.man.html" rel="nofollow">ipset(8)</a>. Only applicable to the&nbsp;<code>hash</code>&nbsp;storage type.</td> 
 </tr> 
 <tr> 
 <td><code>netmask</code></td> 
 <td>integer</td> 
 <td>no</td> 
 <td><code>32</code></td> 
 <td>If specified, network addresses will be stored in the set instead of&nbsp;IP&nbsp;host addresses. Value must be between&nbsp;<code>1</code>&nbsp;and&nbsp;<code>32</code>, see&nbsp;<a href="http://ipset.netfilter.org/ipset.man.html" rel="nofollow">ipset(8)</a>. Only applicable to the&nbsp;<code>bitmap</code>&nbsp;storage type with match&nbsp;<code>ip</code>&nbsp;or the&nbsp;<code>hash</code>&nbsp;storage type with match&nbsp;<code>ip</code>.</td> 
 </tr> 
 <tr> 
 <td><code>maxelem</code></td> 
 <td>integer</td> 
 <td>no</td> 
 <td><code>65536</code></td> 
 <td>Limits the number of items that can be added to the set, only applicable to the&nbsp;<code>hash</code>&nbsp;and&nbsp;<code>list</code>&nbsp;storage types.</td> 
 </tr> 
 <tr> 
 <td><code>hashsize</code></td> 
 <td>integer</td> 
 <td>no</td> 
 <td><code>1024</code></td> 
 <td>Specifies the initial hash size of the set, only applicable to the&nbsp;<code>hash</code>&nbsp;storage type.</td> 
 </tr> 
 <tr> 
 <td><code>timeout</code></td> 
 <td>integer</td> 
 <td>no</td> 
 <td><code>0</code></td> 
 <td>Specifies the default timeout for entries added to the set. A value of&nbsp;<code>0</code>&nbsp;means no timeout.</td> 
 </tr> 
 <tr> 
 <td><code>entry</code></td> 
 <td>setentry</td> 
 <td>no</td> 
 <td><img alt="FIXME" src="/images/20211213/e53f4335f2764405be3fb654c0748937.png"></td> 
 <td><img alt="FIXME" src="/images/20211213/e53f4335f2764405be3fb654c0748937.png"></td> 
 </tr> 
 <tr> 
 <td><code>loadfile</code></td> 
 <td>string</td> 
 <td>no</td> 
 <td><img alt="FIXME" src="/images/20211213/e53f4335f2764405be3fb654c0748937.png"></td> 
 <td><img alt="FIXME" src="/images/20211213/e53f4335f2764405be3fb654c0748937.png"></td> 
 </tr> 
 </tbody> 
</table>

Storage / Match Options

The order of datatype matches is significant

<table> 
 <thead> 
 <tr> 
 <th>Family</th> 
 <th>Storage</th> 
 <th>Match</th> 
 <th>Notes</th> 
 </tr> 
 </thead> 
 <tbody> 
 <tr> 
 <td><code>ipv4</code></td> 
 <td><code>bitmap</code></td> 
 <td><code>ip</code></td> 
 <td>Requires&nbsp;<code>iprange</code>&nbsp;option</td> 
 </tr> 
 <tr> 
 <td><code>ipv4</code></td> 
 <td><code>bitmap</code></td> 
 <td><code>ip mac</code></td> 
 <td>Requires&nbsp;<code>iprange</code>&nbsp;option</td> 
 </tr> 
 <tr> 
 <td><code>ipv4</code></td> 
 <td><code>bitmap</code></td> 
 <td><code>port</code></td> 
 <td>Requires&nbsp;<code>portrange</code>&nbsp;option</td> 
 </tr> 
 <tr> 
 <td>any</td> 
 <td><code>hash</code></td> 
 <td><code>ip</code></td> 
 <td>-</td> 
 </tr> 
 <tr> 
 <td>any</td> 
 <td><code>hash</code></td> 
 <td><code>net</code></td> 
 <td>-</td> 
 </tr> 
 <tr> 
 <td>any</td> 
 <td><code>hash</code></td> 
 <td><code>ip port</code></td> 
 <td>-</td> 
 </tr> 
 <tr> 
 <td>any</td> 
 <td><code>hash</code></td> 
 <td><code>net port</code></td> 
 <td>-</td> 
 </tr> 
 <tr> 
 <td>any</td> 
 <td><code>hash</code></td> 
 <td><code>ip port ip</code></td> 
 <td>-</td> 
 </tr> 
 <tr> 
 <td>any</td> 
 <td><code>hash</code></td> 
 <td><code>ip port net</code></td> 
 <td>-</td> 
 </tr> 
 <tr> 
 <td>-</td> 
 <td><code>list</code></td> 
 <td><code>set</code></td> 
 <td>Meta type to create a set-of-sets</td> 
 </tr> 
 </tbody> 
</table>

### IPv6 ###

As described above, the option `family` is used for distinguishing between IPv4, IPv6 and both protocols. However the family is inferred automatically if IPv6 addresses are used:

config rule
        option  src         'wan'
        option  src_ip      'fdca:f00:ba3::/64'
        option  target      'ACCEPT'

Similar, such a rule is detected as IPv4 only:

config rule
        option  src         'wan'
        option  dest_ip     '88.77.66.55'
        option  target      'REJECT'

*  Rules without IP addresses are automatically added to iptables and ip6tables, *unless overridden by the family option*.
 *  Redirect rules (port forwards) are always IPv4 (for now) since there is no IPv6 DNAT support (yet).

### SNAT ###

![FIXME][] need to find how to use to document this

Options

snats.c:23:	FW3_OPT("enabled",             bool,      snat,     enabled),
    snats.c:25:	FW3_OPT("name",                string,    snat,     name),
    snats.c:26:	FW3_OPT("family",              family,    snat,     family),
    snats.c:28:	FW3_OPT("src",                 device,    snat,     src),
    snats.c:29:	FW3_OPT("device",              string,    snat,     device),
    snats.c:31:	FW3_OPT("ipset",               setmatch,  snat,     ipset),
    snats.c:33:	FW3_LIST("proto",              protocol,  snat,     proto),
    snats.c:35:	FW3_OPT("src_ip",              network,   snat,     ip_src),
    snats.c:36:	FW3_OPT("src_port",            port,      snat,     port_src),
    snats.c:38:	FW3_OPT("snat_ip",             network,   snat,     ip_snat),
    snats.c:39:	FW3_OPT("snat_port",           port,      snat,     port_snat),
    snats.c:41:	FW3_OPT("dest_ip",             network,   snat,     ip_dest),
    snats.c:42:	FW3_OPT("dest_port",           port,      snat,     port_dest),
    snats.c:44:	FW3_OPT("extra",               string,    snat,     extra),
    snats.c:46:	FW3_OPT("limit",               limit,     snat,     limit),
    snats.c:47:	FW3_OPT("limit_burst",         int,       snat,     limit.burst),
    snats.c:49:	FW3_OPT("connlimit_ports",     bool,      snat,     connlimit_ports),
    snats.c:51:	FW3_OPT("utc_time",            bool,      snat,     time.utc),
    snats.c:52:	FW3_OPT("start_date",          date,      snat,     time.datestart),
    snats.c:53:	FW3_OPT("stop_date",           date,      snat,     time.datestop),
    snats.c:54:	FW3_OPT("start_time",          time,      snat,     time.timestart),
    snats.c:55:	FW3_OPT("stop_time",           time,      snat,     time.timestop),
    snats.c:56:	FW3_OPT("weekdays",            weekdays,  snat,     time.weekdays),
    snats.c:57:	FW3_OPT("monthdays",           monthdays, snat,     time.monthdays),
    snats.c:59:	FW3_OPT("mark",                mark,      snat,     mark),
    snats.c:61:	FW3_OPT("target",              target,    snat,     target),

[OpenWrt WIKI]: https://openwrt.org/docs/guide-user/firewall/firewall_configuration
[Netfilter in OpenWrt]: https://openwrt.org/docs/guide-user/firewall/netfilter_iptables/netfilter_openwrt
[aHR0cHM6Ly9vcGVud3J0Lm9yZy9saWIvaW1hZ2VzL3NtaWxleXMvaWNvbl9leGNsYWltLmdpZg]: /images/20211213/003c592a04124e57861372b0fa050752.png
[Gibson Research Corporation]: https://www.grc.com/default.htm
[MSS clamping]: https://en.wikipedia.org/wiki/Path_MTU_discovery#Problems_with_PMTUD
[fw3]: https://openwrt.org/docs/guide-user/firewall/fw3_configurations/start
[ipsets]: http://ipset.netfilter.org/
[FIXME]: /images/20211213/e53f4335f2764405be3fb654c0748937.png