[Solved] Which firewall zones does traffic from my pc go into?

[root-r]

hi everybody,

i have read a lot about firewall zones in the last days, but i'm still not 100% sure if i have understood the concept correctly.

i have a d-link dwr921 c1 lte router and wwan is part of my wan zone.

this is my firewall setup (i have done no changes to the default settings):

General settings
Input : accept
Output: accept
Forward : reject

Zones:
lan: Zone Forwarding lan -> wan / Input accept / Output accept / Forward accept
wan: Zone Forwarding wan -> reject / Input reject / Output accept / Forward reject

so in the case my computer has a wireless lan connection to the router and i want to open a website, i see two possible scenarios:

1. data is sent from my computer to the router and first goes into the lan zone. it is recognized that the data's destination is the internet and therefore a forwarding to the wan zone is taking place. from the wan zone, the traffic is sent out to the internet (since output policy of the wan zone is accept). the requested informations go back to the router and are sent to my computer without re-entering the lan zone.

2. data is sent from my computer to the router and goes directly into the wan zone. rest is like the last two sentences in 1)

so which one is correct? or am i totally wrong and something else is the case?

keep in mind i'm talking about "normal" web browsing and no stuff like ssh.

please help me to understand this. thank you

[vgaetera]

Zone concept is an abstraction above chain concept, you can read something about iptables to understand it better.
The first way is pretty close to the default ruleset result if you take into account RELATED and ESTABLISHED connections.
From this point of view there's no much difference between HTTP/HTTPS and SSH assuming that destination is a host in the wan zone.

[trendy]

Packet enters your router's LAN zone interface LAN. It is examined and router understands that it has to be forwarded to WAN. Forwarding from LAN to WAN is accepted so the packet is sent out of wwan interface.

@root-r

the traffic is sent out to the internet (since output policy of the wan zone is accept)

Wrong, the OUTPUT policy applies to packets originating from the router itself, like when you do a ping from the router or download a package with opkg.

@root-r

the requested informations go back to the router and are sent to my computer without re-entering the lan zone.

Replies coming back to your PC are automatically allowed as previously established connections.

[lleachii]

@root-r

so in the case my computer has a wireless lan connection to the router and i want to open a website, i see two possible scenarios:

1. CORRECT...except WAN output policy part (@trendy's explanation of WAN output is correct) . The LAN WiFi packet goes to WAN because Forward was permitted to WAN. The output setting on WAN is for the WAN interface output only.
2. Wrong, this would imply no firewall.

Also, see this postings I made on the topic:

Recommended firewall settings

First of all, that isn't a LAN to WAN setting of Reject. The enable LAN to WAN is the graphic to the Left of that - under the column "Zone => Forwardings". That entire row is the Zone-based firewall settings for LAN. Each row configures the Zone named on its extreme Left. I believe LAN was accept intra-zone forwarding by default (more on how to find out below). Nonetheless, what you circled is the forwarding of a packet FROM THE LEDE TO ANOTHER ROUTER IN THE SAME ZONE. Most consumers don't use…

Recommended firewall settings

It took me a long time to understand Zone-based firewalls, as I only experienced them in LEDE. Recall that all firewall locations are determined by zones Anything that doesn't fall in one of the listed and defined zones will be covered by the General Zone Setting The first things on the GUI to define is where the Zone can forward to by default (i.e. LAN => WAN) You then define rules for the zone: Input to router from Zone LAN Output from router on Zone LAN Forwarding from this zone to a route…

[root-r]

so the packet actually has to go through the firewall's wan-zone to be able to be sent through the wwan-interface (which belongs to the wan zone)?

also, is it correct that the "input: accept" setting of the lan-zone is only relevant when i try to reach the router itself (e.g. by issuing "ssh root@192.168.1.1" in a terminal after connecting the router to a pc via network cable)?

[trendy]

@root-r

so the packet actually has to go through the firewall's wan-zone to be able to be sent through the wwan-interface (which belongs to the wan zone)?

Yes, more or less. It's different forward when traversing different zones and when traversing interfaces of the same zone. First has to be explicitly allowed, the second is the forward option for each zone next to input and output.

@root-r

also, is it correct that the "input: accept" setting of the lan-zone is only relevant when i try to reach the router itself (e.g. by issuing "ssh root@192.168.1.1" in a terminal after connecting the router to a pc via network cable)?

Correct! Any connection destined to the router itself is looked up in the input rules.

[root-r]

okay, but since the forward policy of my wan-zone is "reject", this can only mean that the informations go directly to the wwan interface after/while entering the wan-zone, right?

the d-link dwr921 also has a "classic" wan-port (additionally to the lte modem i believe). if this wan-port was active and/or the data would go over it in some way to reach the wwan interface, forward policy of the wan-zone would have to be "accept" (since it would be forward from two interfaces in the same zone). is this what you meant?

[dlakelan]

The best way to understand the zone concept is as a set of input ports... LAN zone is the set of ways that packets can come in or out from your LAN (so, some ethernet ports, and some Wifi SSIDs). The WAN zone is a set of ways that packets can go in and out of your internet connection.... wan ethernet ports, wwan SSID clients etc.

When a packet arrives at your router it's assigned a zone based on where it was received. If it needs to be forwarded, it's decided whether it can forward based on whether there is forwarding allowed between the zone it arrived in, and the zone it needs to leave from.

When packets arrive as replies to existing connections, they are allowed through... So if you initiate a connection from your LAN, the return packets are allowed to forward even though in general forwarding from WAN to LAN may be disallowed.

[trendy]

@root-r

okay, but since the forward policy of my wan-zone is "reject", this can only mean that the informations go directly to the wwan interface after/while entering the wan-zone, right?

the d-link dwr921 also has a "classic" wan-port (additionally to the lte modem i believe). if this wan-port was active and/or the data would go over it in some way to reach the wwan interface, forward policy of the wan-zone would have to be "accept" (since it would be forward from two interfaces in the same zone). is this what you meant?

Forward policy in a zone describes what should be the default action for packets traversing interfaces of the same zone. So in your example if a packet ever came from wan interface and was supposed to exit wwan interface, then it would be rejected. This will never happen in WAN, since no sane ISP will use you as a router to forward its traffic.
But it is easier to understand the consept if you have LAN zone and lan1 and lan2 interfaces. There an ACCEPT policy makes sense, to allow traffic between the 2 interfaces of the same zone.

[root-r]

okay, I think I have understood. everything is much clearer now.

thanks a lot to @dlakelan , @lleachii , @trendy and @vgaetera

i really appreciate that users who don't have that much knowledge (yet) can get fast and friendly help in a forum like this

[trendy]

You are welcome and you can mark the title as [Solved] if you are covered! Also you can mark the answer that provided the answer to your question.