How to add interface to existing firewall zone via UCI command line?

[Michael.Uray]

Hi guys,

how can I add a new interface (wan_static) which I created to an existing firewall zone (WAN) via UCI?

I have tried uci add_list firewall.@zone[1].network='wan_static' but this created only a new list network entry instead of extending the existing one.

Michael

[lleachii]

Another option...from the command line/UCI (files):

• vi /etc/config/firewall
• Find config zone and option name 'wan'
• Edit option network 'wan wan6' to option network 'wan_static wan wan6'

[jow]

This is a little bit tricky due to the fact that the default config uses space separated items instead of a true list.
Below is a code snippet that handles this, but its a bit bulky for interactive cli usage:

case "$(uci get firewall.@zone[1].network)" in
  *\ *) uci set firewall.@zone[1].network="$(uci get firewall.@zone[1].network) wan_static" ;;
  *) uci add_list firewall.@zone[1].network="wan_static" ;;
esac

If you just look for a one-off command in an interactive shell session, use uci set firewall.@zone[1].network="$(uci get firewall.@zone[1].network) wan_static" - this should also work if the existing config already uses lists, in which case the value will be converted to a space-separated option again.

[Michael.Uray]

@lleachii

Another option...from the command line/UCI (files):

• vi /etc/config/firewall

Thanks, but I was actually looking for a solution which I can use in a script.

@jow

use uci set firewall.@zone[1].network="$(uci get firewall.@zone[1].network) wan_static"

Thanks jow, this one works well for me.

[vgaetera]

@jow

This is a little bit tricky due to the fact that the default config uses space separated items instead of a true list.

It should be relevant to some older versions, because LEDE 17.01 and OpenWrt 18.06 use list by default:

• https://github.com/openwrt/openwrt/blob/lede-17.01/package/network/config/firewall/files/firewall.config
• https://github.com/openwrt/openwrt/blob/openwrt-18.06/package/network/config/firewall/files/firewall.config

[mikma]

@jow

This is a little bit tricky due to the fact that the default config uses space separated items instead of a true list.

Doesn't the default configuration use lists for the network settings, which are converted to strings by luci?

[jow]

Yes, this may be the case; maybe I misremembered.

[Michael.Uray]

@mikma

Doesn't the default configuration use lists for the network settings, which are converted to strings by luci?

It looks like.

Fresh OpenWRT installation:

config zone
        option name             wan
        list   network          'wan'
        list   network          'wan6'
        option input            REJECT
        option output           ACCEPT
        option forward          REJECT
        option masq             1
        option mtu_fix          1

After adding a new "wan_static" interface via LUCI:

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        option network 'wan wan6 wan_static'