# Default firewall rules

**URL:** <https://forum.openwrt.org/t/default-firewall-rules/66213>\
**Category:** Network and Wireless Configuration\
**Created:** [June 7, 2020, 10:06pm UTC](https://forum.openwrt.org/t/default-firewall-rules/66213 "2020-06-07T22:06:27Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![koukerri](https://forum.openwrt.org/letter_avatar/koukerri/32/5_5575768a8748004e209b776fc1b2916d.png) [@koukerri](https://forum.openwrt.org/u/koukerri)\
**Post date:** [June 7, 2020, 10:06pm UTC](https://forum.openwrt.org/t/default-firewall-rules/66213/1 "2020-06-07T22:06:27Z")

</div>

In Network \> Firewal \> Traffic Rules there are

- Allow-MLD
- Allow-ISAKMP
- Allow-IPSec-ESP

can someone explain what are these, why they are accepted/forwarded by default on openwrt, and why would I want them allowed ?

---

<div class="post-metadata">

**Author:** ![trendy](https://forum.openwrt.org/user_avatar/forum.openwrt.org/trendy/32/8800_2.png) [@trendy](https://forum.openwrt.org/u/trendy)\
**Post date:** [June 8, 2020, 9:20am UTC](https://forum.openwrt.org/t/default-firewall-rules/66213/2 "2020-06-08T09:20:18Z")

</div>

MLD is enabled to receive the multicast packets on the wan link.  
ISAKMP and IPSec-ESP are allowed to enable IPSec tunnel. It is part of IPv6 protocol to enable encryption end to end.  
If you don't use IPv6 you can disable them, however it doesn't hurt leaving them.  
If you enable IPSec tunnel in a lan host over IPv4, you'll need to forward those ports.

---

<div class="post-metadata">

**Author:** ![koukerri](https://forum.openwrt.org/letter_avatar/koukerri/32/5_5575768a8748004e209b776fc1b2916d.png) [@koukerri](https://forum.openwrt.org/u/koukerri)\
**Post date:** [June 8, 2020, 9:23am UTC](https://forum.openwrt.org/t/default-firewall-rules/66213/3 "2020-06-08T09:23:12Z")

</div>

thanks! one question, end to end encryption on ipv6 for what? http?

---

<div class="post-metadata">

**Author:** ![trendy](https://forum.openwrt.org/user_avatar/forum.openwrt.org/trendy/32/8800_2.png) [@trendy](https://forum.openwrt.org/u/trendy)\
**Post date:** [June 8, 2020, 9:24am UTC](https://forum.openwrt.org/t/default-firewall-rules/66213/4 "2020-06-08T09:24:24Z")

</div>

For everything.  
[http://ipv6now.com.au/primers/IPv6PacketSecurity.php](http://ipv6now.com.au/primers/IPv6PacketSecurity.php)

---

<div class="post-metadata">

**Author:** ![system](https://forum.openwrt.org/uploads/default/original/3X/7/4/740520c71f00039bbf001045c682f0ecb25e905a.png) [@system](https://forum.openwrt.org/u/system)\
**Post date:** [June 18, 2020, 9:24am UTC](https://forum.openwrt.org/t/default-firewall-rules/66213/5 "2020-06-18T09:24:26Z")

</div>

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.