How to add interface to existing firewall zone via UCI command line?

Hi guys,

how can I add a new interface (wan_static) which I created to an existing firewall zone (WAN) via UCI?

I have tried uci add_list firewall.@zone[1].network='wan_static' but this created only a new list network entry instead of extending the existing one.


Another option...from the command line/UCI (files):

  • vi /etc/config/firewall
  • Find config zone and option name 'wan'
  • Edit option network 'wan wan6' to option network 'wan_static wan wan6'

This is a little bit tricky due to the fact that the default config uses space separated items instead of a true list.
Below is a code snippet that handles this, but its a bit bulky for interactive cli usage:

case "$(uci get firewall.@zone[1].network)" in
  *\ *) uci set firewall.@zone[1].network="$(uci get firewall.@zone[1].network) wan_static" ;;
  *) uci add_list firewall.@zone[1].network="wan_static" ;;

If you just look for a one-off command in an interactive shell session, use uci set firewall.@zone[1].network="$(uci get firewall.@zone[1].network) wan_static" - this should also work if the existing config already uses lists, in which case the value will be converted to a space-separated option again.

1 Like

Thanks, but I was actually looking for a solution which I can use in a script.

Thanks jow, this one works well for me.

It should be relevant to some older versions, because LEDE 17.01 and OpenWrt 18.06 use list by default:

Doesn't the default configuration use lists for the network settings, which are converted to strings by luci?

1 Like

Yes, this may be the case; maybe I misremembered.

It looks like.

Fresh OpenWRT installation:

config zone
        option name             wan
        list   network          'wan'
        list   network          'wan6'
        option input            REJECT
        option output           ACCEPT
        option forward          REJECT
        option masq             1
        option mtu_fix          1

After adding a new "wan_static" interface via LUCI:

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        option network 'wan wan6 wan_static'

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.