*filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] # Always allow loopback -A INPUT -i lo -j ACCEPT # Allow established/related to talk back in -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # ICMP (ping) from LAN/DMZ (adjust to taste) -A INPUT -i br2 -p icmp -j ACCEPT -A INPUT -i br3 -p icmp -j ACCEPT -A INPUT -i br4 -p icmp -j ACCEPT # SSH to the router from LAN only (adjust/lock down as needed) -A INPUT -i br2 -p tcp --dport 22 -j ACCEPT -A INPUT -i br4 -p tcp --dport 22 -j ACCEPT # DNS & DHCP to the router from LAN/DMZ (dnsmasq) -A INPUT -i br2 -p udp --dport 67:68 -j ACCEPT -A INPUT -i br3 -p udp --dport 67:68 -j ACCEPT -A INPUT -i br4 -p udp --dport 67:68 -j ACCEPT -A INPUT -i br2 -p tcp --dport 53 -j ACCEPT -A INPUT -i br2 -p udp --dport 53 -j ACCEPT -A INPUT -i br3 -p tcp --dport 53 -j ACCEPT -A INPUT -i br3 -p udp --dport 53 -j ACCEPT -A INPUT -i br4 -p tcp --dport 53 -j ACCEPT -A INPUT -i br4 -p udp --dport 53 -j ACCEPT # Forwarding policy: # - LAN -> WAN: allow # - DMZ -> WAN: allow # - WLAN -> WAN: allow # - WAN -> LAN/DMZ: block unless established/related # - LAN <-> DMZ: default block (tight). Uncomment the next line if you want LAN to reach DMZ. -A FORWARD -i br2 -o br0 -j ACCEPT -A FORWARD -i br4 -o br0 -j ACCEPT -A FORWARD -i br3 -o br0 -j ACCEPT # Allow LAN to reach DMZ (optional) -A FORWARD -i br2 -o br3 -j ACCEPT -A FORWARD -i br4 -o br3 -j ACCEPT # Allow LAN and WLAN to reach each other (optional) -A FORWARD -i br2 -o br4 -j ACCEPT -A FORWARD -i br4 -o br2 -j ACCEPT COMMIT *nat :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] # NAT (masquerade) LAN+DMZ out of WAN -A POSTROUTING -o br0 -j MASQUERADE # Example: Port-forward 80 on WAN to a DMZ host 192.168.60.10 # (and allow the forward) #-A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 192.168.60.10:80 #-A FORWARD -i eth0 -p tcp -d 192.168.60.10 --dport 80 -j ACCEPT COMMIT
# manual sudo iptables -I FORWARD 1 -i br1 -o eth0 -j ACCEPT sudo iptables -I INPUT 1 -i br1 -p udp --dport 67:68 -j ACCEPT sudo iptables -I INPUT 1 -i br1 -p udp --dport 53 -j ACCEPT sudo iptables -I INPUT 1 -i br1 -p tcp --dport 53 -j ACCEPT sudo iptables -I INPUT 1 -i br1 -p icmp -j ACCEPT sudo iptables -I INPUT 1 -i br1 -p tcp --dport 22 -j ACCEPT sudo netfilter-persistent save