OpenWrt firewall mystery

[lleachii]

@wangnick

such that mosquitto does NOT listen on 192.168.4.1, then this does not prevent a device in 192.168.4 to simply access mosquitto via e.g. 192.168.2 or 192.168.5. Totally unexpected, at least for me.

You have INPUT on the private network set to ACCEPT.

@wangnick

not knowing that that doesn't prevent access from devices in other LANs even when forwarding is not granted.

Because it's INPUT, not FORWARD. You even linked where I note this:

@lleachii

Nonetheless, what you circled is the forwarding of a packet FROM THE LEDE TO ANOTHER ROUTER IN THE SAME ZONE. Most consumers don't use 2 routers in the same firewall zone (unless one is doing NAT).