Worked rulesets#

Three rulesets, in full, as the Firewall and NAT pages take them: each rule is a row of the rule editor's fields, and a field that is not listed is left as it is. Every address is from a documentation range or RFC 1918; substitute your own.

Throughout: eth1 is the uplink, eth0 is the LAN, eth2 is a second segment.

1. A default-drop edge#

This is what the installer writes when its Firewall box is left checked and a WAN was chosen. It does not need a LAN — a WAN alone is enough for the installer to write it.

The connection state policy, on the Settings tab: Accept established and related connections, Drop invalid packets. Without it, every rule below would need its own state match for return traffic.

On the Rule sets tab, the Input and Forward chains of both families have the default action Drop. The rules, IPv4:

IPv6, the same shape:

Five things in that ruleset are choices:

1. Input rule 10 admits everything from the LAN interface, including the web UI. On a router with this ruleset anything on the LAN can reach the web UI. Narrowing that means replacing rule 10 with rules that name the protocols and ports the LAN may reach on the router.
2. ICMP is accepted on every interface, WAN included. On IPv4 that is a preference: a router that does not answer ping is harder to diagnose. On IPv6 it is not — neighbour discovery and path-MTU discovery are ICMPv6, and dropping them costs the router its own default route.
3. Rule 40 exists so a lease renewal does not depend on connection tracking alone. The installer writes it only when the uplink is DHCP on IPv4; the IPv6 one always, because a delegated prefix arrives over DHCPv6 on providers that do not use plain SLAAC.
4. Nothing here opens the web UI from the WAN, and nothing opens anything through the router from the WAN. Both directions are closed by the chains' default action.
5. A management source, if you gave the installer one, appears as Input rule 50 in the family its address belongs to: Accept, source 203.0.113.0/24, described management source.

An empty Rules tab on a router with an uplink means nothing is filtered. Check the Rule sets tab on both families: a chain whose default action is Accept, with no rules, lets everything through.

2. Publishing one service to the internet#

Two things have to be true for an inbound connection to reach a host behind the router: the destination has to be translated, and the Forward chain has to admit the translated packet. The translation alone does nothing — the packet is rewritten and then meets the Forward chain's default Drop.

The port forward editor does both. For HTTPS to 10.0.10.20:

That adds the port forward and a Forward rule — Accept, TCP, in on eth1, destination 10.0.10.20 port 443 — numbered like the forward when that number is free in the Forward chain. The rule matches the inside address, because that is what the packet carries by the time the Forward chain sees it. When a Forward rule already admits the connections, the editor says which and adds none.

The helper writes IPv4. A service published on IPv6 needs no translation, only a Forward rule in the IPv6 family admitting it.

3. A segment that may not reach the LAN#

A guest or IoT segment on eth2, 10.0.20.0/24, that may reach the internet and the router's own DNS and DHCP, and may not reach the LAN on 10.0.10.0/24. The sets are named once with groups and every rule follows them.

The groups, on the Groups tab:

What the segment may ask of the router itself. The Input chain already drops by default and accepts everything from eth0; eth2 is not eth0, so guests reach nothing on the router until this rule exists:

What the segment may do through the router. The drop has the lower number, because rules are checked in number order:

Rule 40 names the outgoing interface as well as the incoming one, so it admits the segment to the uplink and to nothing else the router can route. Rule 30 is redundant while rule 40 stands as written. It logs the attempts, and it still applies if rule 40 is later widened.

Three things to check in this shape:

• The LAN keeps its own rule. Forward rule 10 from the default-drop edge accepts everything arriving on eth0, which includes the LAN reaching the guest segment. To stop that, add a matching Drop numbered below 10.
• A VLAN is its own interface. If the segment is eth0.20 rather than eth2, choose eth0.20 in these rules; the interface lists include every VLAN.
• Source NAT is separate. Reaching the internet also needs the segment's addresses translated. See source NAT: the installer's masquerade rule matches the LAN network only.

Add IPv6 rules of its own if the segment has IPv6 at all. Nothing above filters it.

Checking any of these worked#

The Packets and Bytes columns of the rule table move as rules match. A rule you expected to match that is not counting is below a rule that matched first, in the wrong chain, or in the wrong address family. A rule with Log matches on writes each match to the router's log, which the Logs page reads.

Undoing one#

Every ruleset above is a set of configuration changes. Two ways back:

• Delete the rules from the rule editor and apply.
• Roll back the applied change from the commit history, which restores the configuration from before it.

If a change has cut you off, neither is reachable. A change applied with auto-revert and never confirmed reverts on its own.

See also#

• Firewall — rules — the editor behind every row above.
• Firewall — groups — the sets used in the third ruleset.
• Port forwards — the editor behind the second one.
• Source NAT — the outbound half of a working segment.
• A default-drop ruleset and publish a service — the guide versions.
• System — history — rolling a ruleset back.
• Commit-confirm — the window that undoes a change that cut you off.