[Solved] New installation OpenWrt 19.07, firewall issues

Installing and Using OpenWrt Network and Wireless Configuration
#1

Hi,
I am a new user of Openwrt and after installation on my Plusnet router (same as BT HH5) on my fttc connection, I thought all was well. Everything seemed good
However today I thought I will test the firewall with ShieldsUP! This reported ports 80 and 22 as open.
I checked syslog and I could see attempts to login from a Russian IP address!.
I have not touched the firewall config, so I was surprised to see this. I have reloaded the firewall (service firewall restart). I have rebooted the router. ShieldsUP! still shows the ports open. Also responses to pings occur, I deleted the 'Allow ping' rule, but this has had no effect.
I am on the point of putting the old router back.
Any help would be greatly appreciated.

Using cat /etc/config/firewall, my firewall rules are:

config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'

config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option network 'lan wan'

config zone
option name 'wan'
option input 'drop'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'wan6 wan'

config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'

config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
option enabled '0'

config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'

config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'

config include
option path '/etc/firewall.user'

#2

Looks to me like you have assigned "wan" interface to be also part of the "lan" zone...
And the defaults there are "accept" for input and forward.

You should naturally remove the wan interface from the trusted lan zone.

1 Like
#3

That was a very speedy reply! It just shows how inexperienced I am with this.
I edited the config as you have said and restarted the firewall. No problems now, a perfect score from ShieldsUP! I am not sure how it ended up in that state.

I am very grateful for your help.

#4

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.