Firewall not working

Installing and Using OpenWrt Network and Wireless Configuration
1

Hi,

My firewall is always showing:

#service firewall status
active with no instances

I have installed:

firewall4 - 2023-03-23-04a06bd7-1 - This package provides an nftables-based implementation of the UCI firewall
 sharing the same configuration format.

I don't see anything in logread that explains why the firewall is active but without any instances.
This is my firewall config:

cat /etc/config/firewall

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list device 'tun0'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list device 'tun0'
	list device 'tun1'
	list device 'tun2'
	list device 'tun3'

config forwarding 'lan_wan'
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config include 'miniupnpd'
	option type 'script'
	option path '/usr/share/miniupnpd/firewall.include'

config rule
	option name 'NOWTV SSH'
	option target 'ACCEPT'
	option src 'wan'
	list src_ip '192.168.0.0/24'
	option dest_port '22'
	option family 'ipv4'

config rule
	option name 'NOWTV ADMIN'
	option src 'wan'
	list src_ip '192.168.0.0/24'
	option dest_port '80'
	option target 'ACCEPT'
	option family 'ipv4'

config zone
	option input 'REJECT'
	option forward 'ACCEPT'
	option output 'REJECT'
	option masq '1'
	option mtu_fix '1'
	option name 'FR'
	list network 'fr'

config forwarding
	option src 'lan'
	option dest 'FR'

config zone
	option name 'HK'
	option input 'REJECT'
	option output 'REJECT'
	option forward 'ACCEPT'
	option masq '1'
	list network 'hk'

config forwarding
	option src 'lan'
	option dest 'HK'

config zone
	option input 'REJECT'
	option forward 'ACCEPT'
	option output 'REJECT'
	option masq '1'
	option mtu_fix '1'
	option name 'US'
	list network 'us'

config forwarding
	option src 'lan'
	option dest 'US'

config zone
	option input 'REJECT'
	option forward 'ACCEPT'
	option output 'REJECT'
	option masq '1'
	option mtu_fix '1'
	option name 'UK'
	list network 'uk'

config forwarding
	option src 'lan'
	option dest 'UK'

config include 'pbr'
	option fw4_compatible '1'
	option type 'script'
	option path '/usr/share/pbr/pbr.firewall.include'
1 Like
2

That is completely normal and expected. The firewall is not a daemon that keeps running, like dnsmasq does.

4 Likes
3

Use fw4 print if you want to see the running configuration.

2 Likes
4

Thanks, I thought I would see the running config with status.
I was trying to figure out why my pbr is not working. I will look at something else then.

5

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.