|
@@ -14,40 +14,16 @@ end
|
|
|
|
|
|
uci:foreach('firewall', 'zone', reject_input_on_wan)
|
|
|
|
|
|
--- the client zone is set up by gluon-client-bridge
|
|
|
---
|
|
|
-uci:section('firewall', 'zone', 'mesh', {
|
|
|
- name = 'mesh',
|
|
|
- network = {},
|
|
|
- input = 'REJECT',
|
|
|
- output = 'ACCEPT',
|
|
|
- forward = 'REJECT',
|
|
|
-})
|
|
|
-
|
|
|
--- allow inbound ssh from anywhere
|
|
|
-for _, zone in ipairs({ 'wan', 'local_client', 'mesh' }) do
|
|
|
- uci:section('firewall', 'rule', zone .. '_ssh', {
|
|
|
- name = zone .. '_ssh',
|
|
|
- src = zone,
|
|
|
- dest_port = '22',
|
|
|
- proto = 'tcp',
|
|
|
- target = 'ACCEPT',
|
|
|
+for _, zone in ipairs ({ 'mesh', 'local_client' } ) do
|
|
|
+ -- Other packages assign interfaces to these zones
|
|
|
+ uci:section('firewall', 'zone', zone, {
|
|
|
+ name = zone,
|
|
|
+ network = {},
|
|
|
+ input = 'REJECT',
|
|
|
+ output = 'ACCEPT',
|
|
|
+ forward = 'REJECT',
|
|
|
})
|
|
|
-end
|
|
|
-
|
|
|
|
|
|
--- allow icmp in/out on all relevant zones
|
|
|
-uci:section('firewall', 'rule', 'local_client_ICMPv4_in', {
|
|
|
- src = 'local_client',
|
|
|
- proto = 'icmp',
|
|
|
- icmp_type = {
|
|
|
- 'echo-request',
|
|
|
- },
|
|
|
- family = 'ipv4',
|
|
|
- target = 'ACCEPT',
|
|
|
-})
|
|
|
-
|
|
|
-for _, zone in ipairs ({ 'mesh', 'local_client' } ) do
|
|
|
uci:section('firewall', 'rule', zone .. '_ICMPv6_in', {
|
|
|
src = zone,
|
|
|
proto = 'icmp',
|
|
@@ -77,4 +53,27 @@ for _, zone in ipairs ({ 'mesh', 'local_client' } ) do
|
|
|
uci:delete('firewall', zone .. '_ICMPv6_out')
|
|
|
end
|
|
|
|
|
|
+uci:section('firewall', 'rule', 'local_client_ICMPv4_in', {
|
|
|
+ src = 'local_client',
|
|
|
+ proto = 'icmp',
|
|
|
+ icmp_type = {
|
|
|
+ 'echo-request',
|
|
|
+ },
|
|
|
+ family = 'ipv4',
|
|
|
+ target = 'ACCEPT',
|
|
|
+})
|
|
|
+
|
|
|
+
|
|
|
+-- allow inbound SSH from anywhere
|
|
|
+for _, zone in ipairs({ 'wan', 'local_client', 'mesh' }) do
|
|
|
+ uci:section('firewall', 'rule', zone .. '_ssh', {
|
|
|
+ name = zone .. '_ssh',
|
|
|
+ src = zone,
|
|
|
+ dest_port = '22',
|
|
|
+ proto = 'tcp',
|
|
|
+ target = 'ACCEPT',
|
|
|
+ })
|
|
|
+end
|
|
|
+
|
|
|
+
|
|
|
uci:save('firewall')
|