OpenWrt as bridge with firewall

Installing and Using OpenWrt Network and Wireless Configuration
21

For some reason, I can no longer edit my previous post, but I just wanted to post my updated configs in case anybody ever wanted to do the same.

image
image1187×709 77.8 KB

Network

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config interface 'offline'
	option proto 'static'
	option netmask '255.255.255.0'
	option ipaddr '192.168.2.1'
	option device 'br-lan.2'

config bridge-vlan
	option device 'br-lan'
	option vlan '1'
	list ports 'lan1:u*'
	list ports 'lan2:u*'
	list ports 'lan3:u*'
	list ports 'lan4:u*'

config bridge-vlan
	option device 'br-lan'
	option vlan '2'
	list ports 'lan1:t'

config device
	option name 'br-lan.1'
	option type '8021q'
	option ifname 'br-lan'
	option vid '1'

config interface 'wan'
	option device 'wan'
	option proto 'static'
	option ipaddr '192.168.1.3'
	option netmask '255.255.255.0'
	option gateway '192.168.1.1'

config interface 'dmz'
	option proto 'static'
	option device 'br-lan.1'
	option ipaddr '192.168.3.1'
	option netmask '255.255.255.0'

config interface 'wandmz'
	option proto 'relay'
	option ipaddr '192.168.1.3'
	list network 'dmz'
	list network 'wan'

Firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option input 'ACCEPT'
	option output 'ACCEPT'
	list subnet '!192.168.1.0/24'
	list network 'wan'
	option name 'wan'
	option forward 'REJECT'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list subnet '192.168.1.0/24'
	list network 'wan'

config zone
	option name 'offline'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'offline'

config include
	option path '/etc/firewall.user'

config zone
	option name 'dmz'
	option input 'ACCEPT'
	option output 'ACCEPT'
	list network 'dmz'
	option forward 'REJECT'

config redirect
	option dest 'dmz'
	option target 'DNAT'
	list proto 'tcp'
	option src_dport '443'
	option dest_ip '192.168.1.201'
	option name 'https'
	option src 'wan'

config redirect
	option dest 'dmz'
	option target 'DNAT'
	option name 'lan-https'
	list proto 'tcp'
	option src 'lan'
	option dest_ip '192.168.1.201'
	option src_dport '443'

config redirect
	option dest 'dmz'
	option target 'DNAT'
	option name 'http'
	list proto 'tcp'
	option dest_ip '192.168.1.201'
	option src_dport '80'
	option src 'wan'

config redirect
	option dest 'dmz'
	option target 'DNAT'
	option name 'lan-http'
	list proto 'tcp'
	option src 'lan'
	option dest_ip '192.168.1.201'
	option src_dport '80'

config redirect
	option target 'DNAT'
	option name 'webadmin'
	list proto 'tcp'
	option src_dport '4321'
	option dest_ip '192.168.1.3'
	option dest_port '80'
	option src 'lan'

config rule
	list proto 'tcp'
	option dest_port '22'
	option target 'DROP'
	option src 'wan'
	option name 'wanssh'

config rule
	list proto 'tcp'
	option src 'dmz'
	option name 'dmzrouter'
	option target 'DROP'

config rule
	option name 'externalsmb'
	list proto 'tcp'
	option src 'dmz'
	list src_ip '192.168.1.201'
	list dest_ip '192.168.1.101'
	option dest_port '445'
	option target 'ACCEPT'
	option dest 'lan'

config rule
	option name 'dmzdns'
	option src 'dmz'
	list dest_ip '192.168.1.1'
	option target 'ACCEPT'
	option dest 'lan'
	list proto 'tcp'
	list proto 'udp'
	option dest_port '53'

config forwarding
	option src 'dmz'
	option dest 'wan'

config forwarding
	option src 'lan'
	option dest 'dmz'

config forwarding
	option src 'lan'
	option dest 'offline'

DHCP

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option localservice '1'
	option ednspacket_max '1232'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'offline'
	option interface 'offline'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option force '1'
	list ra_flags 'none'

config dhcp 'dmz'
	option interface 'dmz'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option ignore '1'

Wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
	option channel '1'
	option band '2g'
	option htmode 'HT20'
	option cell_density '0'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option mode 'ap'
	option encryption 'psk2'
	option key 'mysecret'
	option network 'offline'
	option ssid 'WifiSSID'
22

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.