New Device Option in Firewall Config

[RuralRoots]

I came across this recent forum post reply that caught my eye.

@mk24

The new device option in firewall config allows putting the VPN tunnel into the wan firewall zone without creating a dummy network for it, just add `list device tun0' to the wan zone.

Stunning info!!!!! This made eminent sense to me. After all the time and anguish it took to get to my working solution through forums and wiki.

But, how does the casual joe hear about these changes, because frankly I can't find anything on the forum or wiki about this New Device Option in Firewall Config

I went ahead and followed what I figured needed changed from the post content and I removed from my firewall VPN config:

config zone
	option network 'vpn0'
	option output 'ACCEPT'
	option name 'vpn0'
	option input 'REJECT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'vpn0'`
 

and then added the mentioned

list device vpn0

Under the WAN ZONE section

Low and behold, after restarting Network/Firewall/OpenVPN/Vpn-Poilicy-Routing, it does just what my mind said it should do - WORKED AS EXPECTED.

So, the question is: Where/How do I/We find out about this stuff!!!!!!!!

[vgaetera]

• fw3 initial commit - 8 years
• fw3 wiki docs - 3 years

[RuralRoots]

Well, Mea Culpa!!! Apparently my search skills seem to be lacking though from the dates in your links, I have to wonder about when the new device option timeline was referring.

List of L3 network interface names attached to this zone, e.g. tun+ or ppp+ to match any TUN or PPP interface. Avoid using device if you have already defined network. Using network is preferable in general unless the interface is undeclared.

Frankly, I've gone over this many times but with all due respect as the wiki author, it didn't register. The simple statement to me as a lay person:

firewall config allows putting the VPN tunnel into the wan firewall zone without creating a dummy network for it, just add `list device tun0' to the wan zone.

was immediately intuitive, absorbed, and applied without a hitch. Never saw anything similar in any guides.

I guess that's my point.

[vgaetera]

It has been mentioned here for a couple of years:
https://openwrt.org/docs/guide-user/services/vpn/openvpn/client#firewall