FirewallExample

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 01:05, 16 September 2008 (edit)
0chiehchen (Talk | contribs)
(New page: <pre> # ---------------------- #--- IPTABLES START --- # ---------------------- # # DEFINES: LAN_IP=$(nvram get lan_ipaddr) WAN_IP=$(nvram get wan_ipaddr) # --- # Create ALL_ACCEPT chai...)
← Previous diff
Current revision (05:24, 19 May 2010) (edit) (undo)
Glenn (Talk | contribs)
(chopping up comments)
 
(5 intermediate revisions not shown.)
Line 1: Line 1:
 +Please edit the following rules under your local editor and cut-and-paste these rules into DD-WRT inside Administration Tab -> Commands -> Command Shell box. Click Save Firewall after you are done.
 +
<pre> <pre>
# ---------------------- # ----------------------
Line 34: Line 36:
# --- # ---
-# WebAdmin (please disable DD-WRT Remote Access feature from the web interface if you are only allowing the above IP's)+# WebAdmin (please disable DD-WRT Remote Access feature from the web interface
 +# if you are only allowing the above IP's)
iptables -t nat -I PREROUTING -p tcp -d $WAN_IP --dport 8080 -j DNAT --to-destination $LAN_IP:443 iptables -t nat -I PREROUTING -p tcp -d $WAN_IP --dport 8080 -j DNAT --to-destination $LAN_IP:443
Line 50: Line 53:
# --- # ---
-# SERVER ssh for servers inside DD-WRT network (you can migrate your rules from the DD-WRT Port Forwarding rules here if you are only allowing access from above IP's)+# SERVER ssh for servers inside DD-WRT network (you can migrate your rules from
 +# the DD-WRT Port Forwarding rules here if you are only allowing access from above IP's)
iptables -t nat -I PREROUTING -p tcp -d $WAN_IP --dport 22 -j DNAT --to-destination 10.1.1.30:22 iptables -t nat -I PREROUTING -p tcp -d $WAN_IP --dport 22 -j DNAT --to-destination 10.1.1.30:22
iptables -I NAT -p tcp -d 10.1.1.30 --dport 22 -j ACCEPT iptables -I NAT -p tcp -d 10.1.1.30 --dport 22 -j ACCEPT
Line 58: Line 62:
# --------------------- # ---------------------
</pre> </pre>
 +
 +[[Category:Firewall]]
 +[[Category:Applications settings]]

Current revision

Please edit the following rules under your local editor and cut-and-paste these rules into DD-WRT inside Administration Tab -> Commands -> Command Shell box. Click Save Firewall after you are done.

# ----------------------
#--- IPTABLES START ---
# ----------------------

#
# DEFINES:
LAN_IP=$(nvram get lan_ipaddr)
WAN_IP=$(nvram get wan_ipaddr)

# ---

# Create ALL_ACCEPT chain:
iptables -N ALL_ACCEPT
iptables -P ALL_ACCEPT ACCEPT
# Insert ALL_ACCEPT chain on top of INPUT rules:
iptables -I INPUT -j ALL_ACCEPT

# Create NAT_ACCEPT chain:
iptables -N NAT
iptables -P NAT ACCEPT
# Insert NAT chain on top of INPUT and FORWARD rules:
iptables -I INPUT -j NAT
iptables -I FORWARD -j NAT

# ---

# private subnets (anything FROM these subnets)
iptables -A ALL_ACCEPT -s 192.168.0.0/16 -j ACCEPT

# Allowing any remote IP subnets to access DD-WRT:
iptables -A ALL_ACCEPT -s xxx.xxx.xxx.xxx -j ACCEPT

# ---

# WebAdmin (please disable DD-WRT Remote Access feature from the web interface
# if you are only allowing the above IP's)
iptables -t nat -I PREROUTING -p tcp -d $WAN_IP --dport 8080 -j DNAT --to-destination $LAN_IP:443

# WebAdmin (Allow from all IP's)
#iptables -t nat -I PREROUTING -p tcp -d $WAN_IP --dport 8080 -j DNAT --to $LAN_IP:443
#iptables -I NAT -p tcp -d $WAN_IP --dport 443 -j ACCEPT

# SSH
#iptables -t nat -I PREROUTING -p tcp -m tcp -d $WAN_IP --dport 2122 -j DNAT --to-destination 192.168.1.21:22

# SSH (Allow from all IP's)
#iptables -t nat -I PREROUTING -p tcp -m tcp -d $WAN_IP --dport 2122 -j DNAT --to-destination 192.168.1.21:22
#iptables -I NAT -p tcp -d 192.168.1.21 --dport 22 -j ACCEPT

# ---

# SERVER ssh for servers inside DD-WRT network (you can migrate your rules from
# the DD-WRT Port Forwarding rules here if you are only allowing access from above IP's)
iptables -t nat -I PREROUTING -p tcp -d $WAN_IP --dport 22 -j DNAT --to-destination 10.1.1.30:22
iptables -I NAT -p tcp -d 10.1.1.30 --dport 22 -j ACCEPT

# ---------------------
#--- IPTABLES END ---
# ---------------------