A default-drop ruleset that admits what you meant#

You will end up knowing exactly what your router's firewall does, on both address families, and able to add to it without cutting yourself off. Most Wheelhouse routers already have a default-drop ruleset — the installer writes one — so this guide is as much about reading what is there as about writing something new.

Before you start#

The operator role and a licence.
Know what you have: Protect → Firewall → Rule sets, on IPv4 and then on IPv6. The Input and Forward chains should say Drop under Default action. A chain that accepts by default, with no rules, on a box with a WAN is an emergency, not a preference.

What the installer wrote#

The firewall is written whenever the installer's Firewall box is left checked and there is a WAN. It does not need a LAN — a router with a WAN and no LAN is exactly the machine that must not accept what arrives on it.

On the Settings tab, the connection state policy: Accept established and related connections, Drop invalid packets. On the Rule sets tab, Drop as the default action of the Input and Forward chains of both families. And on the Rules tab:

Family	Chain	#	Action	Matches	Written when
Both	Input	10	Accept	in on the LAN	there is a LAN
Both	Input	20	Accept	in on the loopback	always
IPv4	Input	30	Accept	ICMP	always
IPv6	Input	30	Accept	ICMPv6	always
IPv4	Input	40	Accept	UDP port 68, in on the WAN	the WAN is DHCP
IPv6	Input	40	Accept	UDP port 546, in on the WAN	always
Both	Input	50	Accept	from the management source	you gave one
Both	Forward	10	Accept	in on the LAN	there is a LAN
IPv6	Forward	20	Accept	ICMPv6	always

Four things about it are decisions, and they are the ones to understand before you change anything.

1. Both families are filtered. A box filtered on one family and open on the other is not filtered, and a provider can bring IPv6 up without being asked. If the image turns out to have no IPv6 firewall the installer says so at the end rather than applying a v4-only ruleset silently — check for that message.

2. ICMP is accepted from anywhere, WAN included, on both families. On IPv4 that is a choice you can narrow: a router that does not answer ping is hard to diagnose. On IPv6 it is not a choice — neighbour discovery and path MTU discovery are ICMPv6, and a router that drops them loses its own default route and then breaks every large packet it forwards.

3. The DHCP client is admitted explicitly — UDP port 68 on the WAN for IPv4, 546 for IPv6 — rather than left to depend on connection tracking, so a lease renewal or a delegated prefix cannot be dropped by the default drop.

4. Nothing here opens the web UI from the WAN. With a LAN, the web UI is reachable from the LAN. Without one, it is reachable from the console and from the management source you named at install, and nowhere else.

The two chains, and which one you want#

Chain	Holds traffic that is	Rules you add here
Input	Addressed to the router itself	Reaching the web UI, SSH, DNS, DHCP, NTP, a VPN listener
Forward	Passing through the router to something else	Letting a segment out, admitting a port forward, blocking one VLAN from another

A rule in the wrong chain never matches, and its counter stays on zero.

There is also an Output chain for traffic the router originates. The installer writes no rules in it, and most routers do not want any.

Step 1 — Add a rule#

Protect → Firewall, choose the family, then Add rule and choose the chain under Rule set.

The editor changes only what you set, and a field you clear is removed from the rule rather than left behind. That means the same panel creates and edits — a rule you narrow later loses exactly what you cleared.

Admit SSH to the router from one management network:

Field	Value
Rule set	Input
Rule number	60
Action	Accept
Protocol	TCP
Source	Address or network: `192.0.2.0/28`
Destination port	22
Description	ssh from management

Let one VLAN out to the internet but not into anything else:

Field	Value
Rule set	Forward
Rule number	30
Action	Accept
Incoming interface	eth0.30
Outgoing interface	eth1 — the uplink
Description	guest out

The editor also matches on groups, countries, a schedule, a rate and repeat connections; Firewall — rules describes every field, and Use groups instead of literals the groups.

Step 2 — Choose the number carefully#

Rules are checked in number order and the first match wins. Leave gaps: the installer uses 10, 20, 30, so 15 fits between two of them and 60 goes on the end. The panel suggests the next free number and refuses one that is taken.

Step 3 — Apply with auto-revert#

Check it worked#

Hit counters. The Firewall page shows the router's own counters on each rule. A rule that should be matching and is not stays on zero.

Test the thing itself, from the side it should work from and from the side it should not:

bash

# should work, from the management network
nc -vz 192.0.2.1 22
# should not, from anywhere else
nc -vz 203.0.113.2 22

Turn on logging while you are debugging — Log matches on the rule — and watch the Logs page. Turn it off afterwards; a logging rule on a busy chain fills the log.

Undoing it#

Open the rule and Delete rule. Or turn on Disabled first, which keeps the rule and its number while you find out whether you needed it.

If a change has already locked you out, see Locked out of the UI.