Yikes! - fw3 defaults to allowing NAT forwards

[lleachii]

@vevere

But in my case I (really) don't know what is SNAT

Then why are you looking at it?

Wouldn't you go to a site like this instead of a router manual:

SNAT vs DNAT: Detailed Comparison Table - IP With Ease

@vevere

That's the same thing in many many many computer bioses:
Function Foo: yes/no with the comment: Used to enable the Foo fonction clap clap clap, thank you, very usefull

???

@vevere

Same thing here (just another exemple, I really don't care about that today)

Why do you assume a router manual will tell you these things???

TCP window scale option

You have not once showed an example of an iptables rule you are trying to place into OpenWrt.

@vevere

... but nowhere .. NOWHERE ... on this doc it is explained how to do that with LUCI ... you can only find how to do that with the configuration files.

Did you actually look????

@vevere

Even the most beginning of the firewall configuration doesn't visually match the configuration files organisation if you don't carrefully understand how it works on the files vs how it works on Luci

No, you did not look:

@vevere

.... but, because it is on the same line it is confusing.

Regarding zones:

Recommended firewall settings

First of all, that isn't a LAN to WAN setting of Reject. The enable LAN to WAN is the graphic to the Left of that - under the column "Zone => Forwardings". That entire row is the Zone-based firewall settings for LAN. Each row configures the Zone named on its extreme Left. I believe LAN was accept intra-zone forwarding by default (more on how to find out below). Nonetheless, what you circled is the forwarding of a packet FROM THE LEDE TO ANOTHER ROUTER IN THE SAME ZONE. Most consumers don't use…

@vevere

There should be a better solution to display that no ?

???

@vevere

English, it is not my native language

Welcome to the OpenWrt Project

(If you don't know firewall terms, but are looking at a router's manual in the firewall section...how do you know what you want to configure?)

EDIT: And I digress, I realized you are not the OP.