atErik
DD-WRT Novice
Joined: 25 Apr 2019
Posts: 26
|
 Posted: Fri Feb 21, 2020 13:58 Post subject: |
 |
Hi @egc, Thanks, . . . . . . . . . (my POST-9 in this thread)
adopted/converted your given br0 & guest-net rules,
for this/my ddwrt-router's VLANs, APs/WAPs/VAPs, Bridges.
please see firewall rules.
i have attempted to translate the words & sentences which are used
in that PASTEBIN instruction, and tried to explain with different words
in order to make those rules/functionalities more meaningful & more
descriptive , so that, those can make more sense or can be more easy to
understand for general/new level users,
if possible wud you pls kindly take a look at those #comment lines
& please see/check if my translation is valid or not,
for the same iptables rule.
btw, what does "(internet only)" means/signifying ?
c = 192.168… . ip = ip-address . gw = gateway . sm = SubnetMask.
d1 = dns1 . d2 = dns2 . br = bridge (logical-switch) . rtr = router.
wl = WLAN (can work as WiFi AP or Virtual-AP/VAP) . adrs = address.
nif = network-interface . nic = network-interface card/adapter.
vlan = virtual-LAN, in ddwrt its the physical/wired ethernet port/switch.
 = ✅ = working ,  = ❎ = not-working
DDWRT-CONFIG-62
My expected network-packet movement summary & this/my ddwrt-rtr's internal network-devices info:
DDWRT RTR-2's br0 has ip c.10.251, sm /24, gw+dns c.10.254.
gw c.10.254 in RTR-2's traffic goes into RTR-1, then into Internet.
RTR-2's vlan4 + wl1.2 <-> interlinked with br1 : uses c.20.0/24 subnet <-> br0 <-> Internet.
RTR-2's vlan3 + wl1.1 <-> interlinked with br2 : uses c.30.0/24 subnet <-> br3 <-> br0 <-> Internet.
RTR-2's wl1.3 <-> interlinked with br4 : uses c.32.0/24 subnet <-> br3 <-> br0 <-> Internet.
br1 has ip c.20.1 , br2 has ip c.30.1,
br4 has ip c.32.1 , br3 has ip c.31.1
i used hardware network-switch device & wired multiple client-devices
(and also WiFi client devices) , and connected behind this/my DDWRT
RTR-2 LAN-ports or connected with AP/VAP, etc to find out , which can
ping/etc to/from which device.
please check my previous post where i posted
Additional-Config for DNSMASQ
Startup script
current firewall rules for DDWRT-CONFIG-62 :
| IPTABLES Rules wrote: | # Firewall / iptables rules/script for DDWRT rtr in "CB" wireless-mode + "router" operating-mode.
# Remove all Lines which start with the "#" symbol, (including+like this line), before "Save Firewall"
#
# nif = network-interface . ip = IP-address . adrs = address . net = network . gw = gateway
# subnet = sub/smaller section of a slightly bigger network . c = 192.168
# sm = subnet-mask ( for example, the 255.255.255.0 is = /24 cidr )
#
#
# br1 : ip: c.20.1/24 : has DHCP : wl1.2+vlan4 users go thru this/br1 into br0/gw
# deny incoming net-traffic which coming from outside for+into br1-users, except below allowed ones:
iptables -I INPUT -i br1 -j REJECT
# allow only incoming essential router services (ICMP, DHCP/67 & DNS/53) from outside for+into br1-users:
iptables -I INPUT -p icmp -i br1 -j ACCEPT
iptables -I INPUT -p udp -i br1 --dport 67 -j ACCEPT
iptables -I INPUT -p tcp -i br1 --dport 53 -j ACCEPT
iptables -I INPUT -p udp -i br1 --dport 53 -j ACCEPT
# deny br1-users access, into br0-subnet (internet only)
iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j REJECT
# allow br1-users access, to a printer IP-Adrs on br0-subnet (optional rule, just as an example)
#iptables -I FORWARD -i br1 -o br0 -p tcp -d 192.168.PRINTER.IP-ADRS \
# --dport 9100 -m state --state NEW -j ACCEPT
# deny br0-users access, into this/br1-subnet (optional rule)
iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j REJECT
# apply NAT on this(c.20.0/24) subnet outgoing traffic & send thru br0 (in "CB" mode, WAN/internet-facing-gateway's nif is br0)
iptables -t nat -I POSTROUTING -s 192.168.20.0/24 -o br0 -j MASQUERADE
#
#
# br2 : ip: c.30.1/24 : has DHCP : wl1.1+vlan3 users go thru this/br2 into br3
# deny incoming net-traffic which coming from outside for+into br2-users, except below allowed ones:
iptables -I INPUT -i br2 -j REJECT
# allow only incoming essential router services (ICMP, DHCP/67 & DNS/53) from outside for+into br2-users:
iptables -I INPUT -p icmp -i br2 -j ACCEPT
iptables -I INPUT -p udp -i br2 --dport 67 -j ACCEPT
iptables -I INPUT -p tcp -i br2 --dport 53 -j ACCEPT
iptables -I INPUT -p udp -i br2 --dport 53 -j ACCEPT
# deny br2-users access, into br3-subnet (internet only)
iptables -I FORWARD -i br2 -o br3 -m state --state NEW -j REJECT
# deny br2-users access, into br0-subnet (internet only)
iptables -I FORWARD -i br2 -o br0 -m state --state NEW -j REJECT
# allow br2-users access, to a printer IP-Adrs on br3-subnet (optional rule, just as an example)
#iptables -I FORWARD -i br2 -o br3 -p tcp -d 192.168.PRINTER.IP-ADRS \
# --dport 9100 -m state --state NEW -j ACCEPT
# deny br0-users access, into this/br2-subnet (optional rule)
iptables -I FORWARD -i br0 -o br2 -m state --state NEW -j REJECT
# apply NAT on this(c.30.0/24) subnet outgoing traffic & send thru br3
iptables -t nat -I POSTROUTING -s 192.168.30.0/24 -o br3 -j MASQUERADE
#
#
# br4 : ip: c.32.1/24 : has DHCP : wl1.3 users go thru this/br4 into br3
# deny incoming net-traffic which coming from outside for+into br4-users, except below allowed ones:
iptables -I INPUT -i br4 -j REJECT
# allow only incoming essential router services (ICMP, DHCP/67 & DNS/53) from outside for+into br4-users:
iptables -I INPUT -p icmp -i br4 -j ACCEPT
iptables -I INPUT -p udp -i br4 --dport 67 -j ACCEPT
iptables -I INPUT -p tcp -i br4 --dport 53 -j ACCEPT
iptables -I INPUT -p udp -i br4 --dport 53 -j ACCEPT
# deny br4-users access, into br3-subnet (internet only)
iptables -I FORWARD -i br4 -o br3 -m state --state NEW -j REJECT
# deny br4-users access, into br0-subnet (internet only)
iptables -I FORWARD -i br4 -o br0 -m state --state NEW -j REJECT
# allow br4-users access, to a printer IP-Adrs on br3-subnet (optional rule, just as an example)
#iptables -I FORWARD -i br4 -o br3 -p tcp -d 192.168.PRINTER.IP-ADRS \
# --dport 9100 -m state --state NEW -j ACCEPT
# deny br0-users access, into this/br4-subnet (optional rule)
iptables -I FORWARD -i br0 -o br4 -m state --state NEW -j REJECT
# apply NAT on this(c.32.0/24) subnet outgoing traffic & send thru br3
iptables -t nat -I POSTROUTING -s 192.168.32.0/24 -o br3 -j MASQUERADE
#
#
# br3 : ip: c.31.1/24 : has NO DHCP : br2 & br4 users go thru this/br3 into br0/gw
# deny incoming net-traffic which coming from outside for+into br3-users, except below allowed ones:
iptables -I INPUT -i br3 -j REJECT
# allow only incoming essential router services (ICMP, DHCP/67 & DNS/53) from outside for+into br3-users:
iptables -I INPUT -p icmp -i br3 -j ACCEPT
iptables -I INPUT -p udp -i br3 --dport 67 -j ACCEPT
iptables -I INPUT -p tcp -i br3 --dport 53 -j ACCEPT
iptables -I INPUT -p udp -i br3 --dport 53 -j ACCEPT
# deny br3-users access, into br0-subnet (internet only)
iptables -I FORWARD -i br3 -o br0 -m state --state NEW -j REJECT
# allow br3-users access to a printer IP-Adrs on br0-subnet (optional rule, just as an example)
#iptables -I FORWARD -i br3 -o br0 -p tcp -d 192.168.PRINTER.IP-ADRS \
# --dport 9100 -m state --state NEW -j ACCEPT
# deny br0-users access, into this/br3-subnet (optional rule)
iptables -I FORWARD -i br0 -o br3 -m state --state NEW -j REJECT
# apply NAT on this(c.31.0/24) subnet outgoing traffic & send thru br0
iptables -t nat -I POSTROUTING -s 192.168.31.0/24 -o br0 -j MASQUERADE
|
now, RESULT of DDWRT-CONFIG-62 | = ✅ = working | = ❎ = not-working
1. RTR-2's vlan1 (LAN-Port#4) devices can have bridged network from RTR-1
2. inside the rtr-2 (telnet shell) , it can ping devices & net-interfaces
in any subnets
-
3a. tun1 of OpenVPN-client can resolve VSP's VPN-server domain-name
& can connect with vpn server
3b. vpn-client can auto-start after reboot
-
4a. vlan4 wired devices (connected to br1) can obtain DHCP has ip,dns,etc
from c.20.0/24 subnet.
4b. vlan4/br1 devices do not have full internet-access
4c. ping to an internet server, i.e: ping 9.9.9.9 -c 2 <-- does-not succeed
4d. when i ping into a domain-name (for example: ping dns9.quad9.net -c 2)
from vlan4/br1 devices, ping can show the dns-resolved ip-adrs (inside a
pair of braces), but ping/ICMP itself does not succeed
4e. vlan4/br1 devices cannot ping/access other devices (for example: c.20.38 )
in same subnet c.20.0/24 (br1/vlan4/wl1.2)
4f. but vlan4/br1 devices can ping interface/nif's ip-adrs (for example: c.20.1)
under same subnet.
4g. so net device isolation under same subnet is working
4h. vlan4/br1 devices can ping/access other devices (for example: c.30.38 )
in other subnets (br2/vlan3/wl1.1/c.30.0/24, br4/wl1.3/c.32.0/24, br3/c.31.0/24)
and can also ping other subnet interface/nif's ip-adrs (for example c.30.1).
4i. so subnet net-isolation with other subnets inside same rtr is not-working
4j. and i think, if vlan4/wl1.2/br1 devices cannot even ping other subnet interface/nif's
ip-adrs (i.e: c.30.1) then that wud've been better.
4k. ntp connection to ntp-server's ip-adrs in internet, does not succeed
-
5. wifi devices cannot remain connected with wl1.2/br1 VAP
(because of no network/DHCP & so no local-internet connectivity)
-
6. wifi devices cannot remain connected with wl1.1/br2 VAP
(because of no network/DHCP & so no internet via-VPN connectivity)
-
7. wifi devices cannot remain connected with wl1.3/br4 VAP
(because of no network/DHCP & so no internet via-VPN connectivity)
-
8a. vlan3 wired devices (connected to br2) can obtain DHCP has ip,dns,etc
from c.30.0/24 subnet.
8b. vlan3/br2 devices have full internet-access devices can exit-out on VPN
exit server
8c. ping into an internet server, i.e: ping 9.9.9.9 -c 2 <-- succeeds,
via VPN exit-point
8d. when i ping into a domain-name from vlan3/br2 devices, ping can show the
dns-resolved ip-adrs (inside a pair of braces), and ping/ICMP also succeeds
8e. vlan3/br2 devices cannot ping/access other devices (for example: c.30.38 )
in same subnet (br2/vlan3/wl1.1/c.30.0/24) but can ping interface/nif's
ip-adrs (for example: c.30.1) under same subnet.
8f. so device isolation under same subnet is working
8g. vlan3/br2 devices cannot ping/access other devices (for example: c.20.38 )
in other subnets (br1/vlan4/wl1.2/c.20.0/24, br4/wl1.3/c.32.0/24, br3/c.31.0/24)
but can ping other subnet interface/nif's ip-adrs (for example c.20.1).
8h. so net-isolation with other subnets inside same rtr is also working, i think
8i. but i think, if devices cannot even ping other subnet interface/nif's ip-adrs (i.e: c.20.1)
then that wud've been better.
8j. ntp connection to ntp-server's ip-adrs in internet, succeeds
QUESTIONs:
though i can see each nif section now has one rule to restrict br0,
but br0 still can access other subnets, so i should add a separate
1st section for br0 with stronger/stricter rules ?
shu'd i allow udp 68 too with 67 for DHCP ?
i shu'd enable SPI in Security config-page, & then try/test iptables
firewalls rules ? ( i want-to & will keep SPI enbaled, so i think i should
enbale SPI at this stage, so that i/we can find out if new firewall
rules are actually working or not )
EDIT : adding my post's number, & adding ddwrt CONFIG/test/attempt number,
& changed wide-paragraphs into multiline based paragraphs.
Last edited by atErik on Fri Feb 28, 2020 7:06; edited 4 times in total |
|
atErik
DD-WRT Novice
Joined: 25 Apr 2019
Posts: 26
|
| Posted: Wed Feb 26, 2020 12:42 Post subject: |
|
this is my POST-10 in this forum-thread
few annoying things i have been noticing in this DDWRT router that:
after firewall/iptables changes, a complete Shutdown+Startup
or Shutdown+Restart process of the DDWRT router device
gives better & actual result,
bcuz ( i have been noticing/watching that ) just after a "Reboot"
( or "Apply-Changes" ) ,
some responses from DDWRT router are indeed wrong response !
sometime i needed to wait around 1 to 2 minutes,
before i could do network tests for receiving correct response.
And it appears to me that, When any changes done in "Networking.asp"
or in VPN("PPTP.asp") or in few other specific ddwrt config-webpages,
& then a "SAVE" or "APPLY-CHANGES" button was used or a "Reboot" button
was used ,
then AFTER REBOOTING or AFTER APPLYING-CHANGES
a GHOST WIFI AP (AccessPoint) with MAC-Adrs 00:00:00:00:00:00
from XEROX manufacturer shows up !!
& that has same SSID name used in VAP (virtual-APs) wl1.2 or wl1.1 !!
in a WIFI ANALYZER device or in App, all SSID & MAC-Adrs can be seen very easily.
( here MAC-Adrs does not mean APPLE-company's Mac,MacBook,etc computer(s)
or macOS or MacOS,etc
here MAC-Adrs means Media-Access-Control Address, which is a special hexbyte number,
it is used to identify each networking/communication-devices used in computers,
phones,etc,etc )
when that GHOST AP/WAP/VAP is present, then TWO MAC-addresses (for
same SSID)
gets AUTO-ALLOWED / AUTO-APPROVED by wifi-client-devices when
they connect with a DDWRT WiFi WAP/VAP/AP !!
thats not good, actually very bad . Client-devices does not warn users
about the unsafe GHOST SSID / GHOST MAC-Adrs which it just approved.
Such is allowed ( that is, SAME SSID & multiple different MAC-adrses
is allowed ) when WIFI extenders, etc are used,
BUT a thief ( group-of or a data-thief, or fishy-hacker, or fishy-state-agent,
or friend/fiend/relative who already has that SSID's passcode ) ,
can come close to your home/work DDWRT router
& can impersonate with your visible/broadcasted SSID & that
known ghost MAC-Adrs ( 00:00:00:00:00:00 )
and start capture/intercept/RECORD your SSID net-traffics.
So client-devices need to warn users about this unsafety,
as such warning wud be justified to increase Security+Privacy protection measures/steps.
i think this (GHOST AP presence) is happening because of some type of hack done
by DDWRT/WRT/BusyBox devs for applying network changes temporarily into
a (temporary) net device inside the router , before the changes are completely
applied after a Shutdown+Startup process.
or its an authentic bug waiting to be fixed/reported.
or its an intentional bug ( or a backdoor )
once router is Shutdown+Restarted, & when NO conflicting configs
were given into DDWRT , then that GHOST AP does not appear.
so remove the MAC-adrs of that Ghost wifi WAP/VAP/AP from your allowed/approved
list of SSID+MAC-Adrs , by using such an App (in your wifi-client) that allows you
to inspect+see pre-approved SSID & their used MAC-addresses.
( i.e: in Android you may use "WiFi Privacy Police" by "UHasselt" )
in your WiFi-Analyzer app, you can see list of all nearby WiFi AP/stations SSID,
MAC-Adrs, etc, etc , find out if there are more than one device
with same SSID name, or find out if there are more than one device
with two different signal levels but have same SSID & same MAC-adrs,
if you see such ,
then do not join or connect-with that SSID , as TWO or MORE MAC-Adrs
will be added/approved by your wifi device.
Back to DDWRT configuration,
now trying DDWRT-CONFIG-75
box-diagram for current ddwrt config 75 :
( in previous diagrams, i have shown arrows from wl1.1, wl1.2 & wl1.3 going into wl1,
sorry, it should have been opposite ( as wl1.x are under wl1 ) , & tun1 remain
connected with wl0 instead of br0, fixed that & other mistakes, etc )
Firewall SPI is now turned ON.
and WiFi wl1.3 & wl1.2 , began to work again
and after further refinement of iptables rules & slight DNSMASQ changes,
even the WiFi wl1.1 VAP has began to work
so DNSMASQ additional config and iptables rules does affect VAPs, VLANs,
which is ofcourse how it should be.
check/see these links, if you want to see/understand more iptables rules:
IPTABLES / FIREWALL commands/rules:
https://wiki.dd-wrt.com/wiki/index.php/Iptables_command
iptables original dev's page:
https://netfilter.org/documentation/HOWTO//packet-filtering-HOWTO-7.html
those who want more done during router Startup, can see this:
https://wiki.dd-wrt.com/wiki/index.php/Startup_Scripts
Startup script : ( DDWRT-CONFIG-75 )
its still same as DDWRT-CONFIG-60, pls go back to previous page
& find that paragraph under
"DDWRT-CONFIG-60" https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1192085#1192085
dnsmasq Additional-Config lines : ( DDWRT-CONFIG-75 )
| Quote: | local-service
bind-dynamic
dns-loop-detect
listen-address=127.0.0.1,192.168.10.251,192.168.20.1,192.168.30.1,192.168.32.1
# change "NTP.SRVR.IP.ADRS" into real ip-adrs, then remove all lines that starts with "#" symbol
dhcp-option=option:ntp-server,NTP.SRVR.IP.ADRS
dhcp-option=br1,3,192.168.20.1
dhcp-option=br1,6,192.168.20.1
dhcp-option=br2,3,192.168.30.1
dhcp-option=br2,6,10.10.5.1,192.168.30.1
dhcp-option=br4,3,192.168.32.1
dhcp-option=br4,6,10.10.5.1,192.168.32.1
|
Firewall (iptables) NOTE : ( DDWRT-CONFIG-75 )
| Quote: | # Firewall / iptables rules/script for DDWRT rtr in "CB" wireless-mode + "router" operating-mode.
# DO NOT SAVE LONG OR MANY-MANY #COMMENT LINES IN THE DDWRT NVRAM.
# REMOVE ALL LINES WHICH START WITH the "#" SYMBOL, (including+like this line), BEFORE "SAVE FIREWALL"
# OR ELSE, these extra lines MAY FILL-UP YOUR NVRAM & BRICK/FAIL/DAMAGE YOUR ROUTER PERMANENTLY.
# Lines which start with "#" symbol, are called COMMENT LINES, & they ARE NOT NEEDED for router CONFIG.
# ( you can keep/save these all rules + #COMMENTS in a note or file in your computer/device )
# ( use "FIND+REPALCE" method in your Text-Editor, to remove all lines that start with "# " )
#
#
# Dual radio wl0/eth1 & wl1/eth2 ROUTER (RTR-2) (Broadcom/MIPSEL)
# its in DDWRT CLIENT-BRIDGE wireless-mode (wl0 <-> RTR-1), & in "ROUTER" operating-mode.
# default config: br0 has eth1+eth2+vlan1+...
# My Config: br0 has eth1+eth2+vlan1 , br1 has vlan4+wl1.2 , br2 has vlan3+wl1.1, br4 has wl1.3
# vlan1 in RTR-2 must have bridged net <-> br0 (RTR-2) <-> RTR-1 ("GATEWAY"-router) <-> Internet.
# vlan4+wl1.2 <-> bridged with br1 (and AP-isolated-subnet) <-> br0/wl0.
# vlan3+wl1.1 <-> bridged with br2 (and AP-isolated-subnet and
# devices are net-isolated/net-partitioned) <-> br3 <-> br0/wl0, initially,
# wl1.3 <-> bridged with br4 (and AP-isolated-subnet and
# devices are net-isolated/net-partitioned) <-> br3 <-> br0/wl0, initially,
# when OpenVPN-Client starts, vlan3+wl1.1+wl1.3 subnets br2 & br4 must go thru tun1 10.10.4.x VPN-tunnel
#
#
# nif = network-interface . ip = IP-address . adrs = address . net = network . gw = gateway
# subnet = sub/smaller section of a slightly bigger network . c = 192.168
# sm = subnet-mask ( for example, the 255.255.255.0 is = /24 )
# isolate = cannot-access = separate . VSP = VPN Service Provider
# -s = src = source , -d = dst = destination
# -p = protocol , -j = jump , -i = in-interface , -o = out-interface , -t = table (default: "filter")
# --dport = dst port , --sport = src port , -I = insert into a chain , -A = append into a chain
# -m = match
# wl = wireless-LAN . br = bridge = logical-Switch . vlan = virtual-LAN = wire/cable-ethernet Port
# when a table not-specified in iptables rule, default table "filter" is used.
#
#
# br1 subnet is isolated from br0,br2/br4/br3,tun1,vlan2,etc ALL other-subnets,
# but device+user inside br1 subnet can access any other device+user only in same-subnet br1.
# br2 subnet is isolated from br0,br1,br4,tun1,vlan2,etc other-subnets,
# and any device+user inside br2 subnet is also isolated from any other device+user in same-subnet br2.
# br4 subnet is isolated from br0,br1,br2,tun1,vlan2,etc other-subnets,
# and any device+user inside br4 subnet is also isolated from any other device+user in same-subnet br4.
# br3 subnet is isolated from br0,br1,tun1,vlan2,etc other-subnets,
# and any device+user inside br3 subnet is also isolated from any other device+user in same-subnet br3.
# tun1 subnet is created by OpenVPN-Client by obtaining dynamic settings from remote VPN Server,
# and any device+user inside tun1 is also isolated from any other device+user in same-subnet tun1.
# and also isolated from br0,br1,br2/br4/br3,vlan2,etc other-subnets.
#
#
# DNSMASQ is the local DHCP+DNS server/resolver software/app/system-service-provider.
# its Listening on port-53 for DNS & port-67 for DHCP on each of these nif/ip-adrs:
# 127.0.0.1*, 192.168.10.251, 192.168.20.1, 192.168.30.1, 192.168.32.1
# ( * DHCP is not active on localhost/127.0.0.1, so localhost not listening on port-67 )
|
To increase security & privacy, i have added more restrictive/stricter firewall (network packet filtering) rules.
Firewall/iptables RULES To Use/Save in DDWRT : (DDWRT-CONFIG-75)
| Quote: | # REMOVE All (#COMMENT) Lines That Starts With "#" Symbol Then Do "Save Firewall"
# OR ELSE YOUR ROUTER's NVRAM WILL/MAY FILL-UP, & FAIL/MALFUNCTION PERMANENTLY.
# The #COMMENT Lines Are Not Needed by DDWRT Config/Settings.
# The #COMMENT Lines Are Shown For Human/User To Understand the Rules.
# User Can Save ALL in Their Own Notes/Devices/Computers , but not in Router Config.
#
#
# br0 (in RTR-2) : ip: c.10.251/24 : "Client-Bridge" wireless-mode created+uses this br0.
# eth1(wl0)+eth2(wl1)+vlan1 <-> br0 (RTR-2) <-> RTR-1 <-> internet.
# dns: c.10.254 , gw: c.10.254
# deny br0-users access, into br1 nif+subnet
# iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP
# deny br0-users access, into c.20.1/24 (br1) subnet
iptables -I FORWARD -i br0 -d 192.168.20.1/24 -m state --state NEW -j DROP
# deny br0-users access, into br2 nif+subnet
# iptables -I FORWARD -i br0 -o br2 -m state --state NEW -j DROP
# deny br0-users access, into c.30.1/24 (br2) subnet
iptables -I FORWARD -i br0 -d 192.168.30.1/24 -m state --state NEW -j DROP
# deny br0-users access, into br3 nif+subnet
# iptables -I FORWARD -i br0 -o br3 -m state --state NEW -j DROP
# deny br0-users access, into c.31.1/24 (br3) subnet
iptables -I FORWARD -i br0 -d 192.168.31.1/24 -m state --state NEW -j DROP
# deny br0-users access, into br4 nif+subnet
# iptables -I FORWARD -i br0 -o br4 -m state --state NEW -j DROP
# deny br0-users access, into c.32.1/24 (br4) subnet
iptables -I FORWARD -i br0 -d 192.168.32.1/24 -m state --state NEW -j DROP
# deny br0-users access, into (VPN-Client's) tun1 nif+subnet. tun1 obtains ip/etc from VSP
iptables -I FORWARD -i br0 -o tun1 -m state --state NEW -j DROP
#
#
# br1 : ip+dns+gw: c.20.1/24 : has DHCP : wl1.2+vlan4 users go thru this/br1 into br0/gw
# accept those net-traffic, which coming via br0 into Lan-GW c.10.254 & destined to c.20.1
# iptables -t nat -I PREROUTING -i br0 -d $(nvram get lan_gateway) -j DNAT --to 192.168.20.1
# Net-traffic which coming via br1 for tcp+udp port-53, send those into (DNSMASQ's) LAN/br0 DNS-Listening IP-addr c.10.251(lan_ipaddr)
# iptables -t nat -I PREROUTING -i br1 -p tcp --dport 53 -j DNAT --to $(nvram get lan_ipaddr)
# iptables -t nat -I PREROUTING -i br1 -p udp --dport 53 -j DNAT --to $(nvram get lan_ipaddr)
# Tcp+Udp net-traffic which coming via br1 for/into ip c.20.1 port-53 from c.20.0/24 subnet, send those to (DNSMASQ's) DNS/53-port Listening IP-addr c.20.1:53
iptables -t nat -I PREROUTING -p tcp -i br1 -s 192.168.20.0/24 -d 192.168.20.1 --dport 53 -j DNAT --to 192.168.20.1:53
iptables -t nat -I PREROUTING -p udp -i br1 -s 192.168.20.0/24 -d 192.168.20.1 --dport 53 -j DNAT --to 192.168.20.1:53
# iptables -t nat -I PREROUTING -p tcp -i br1 -d 192.168.20.1 --dport 53 -j DNAT --to 192.168.20.1:53
# iptables -t nat -I PREROUTING -p udp -i br1 -d 192.168.20.1 --dport 53 -j DNAT --to 192.168.20.1:53
# deny incoming net-traffic (after a default wait-period), which coming via br1-nif:
# iptables -I INPUT -i br1 -j REJECT
# deny incoming net-traffic instantly, which coming via br1-nif:
iptables -I INPUT -i br1 -j DROP
# allow only incoming essential router services (ICMP, DHCP/67 & DNS/53) coming via br1-nif:
# allow any icmp coming via br1
# iptables -I INPUT -p icmp -i br1 -j ACCEPT
# allow br1-subnet users to send PING/ICMP into another user in same br1-subnet only
iptables -I INPUT -p icmp -i br1 -s 192.168.20.0/24 -d 192.168.20.0/24 -j ACCEPT
# allow incoming udp net-traffic via br1 into+for port 67 & 68, (to use DHCP)
# iptables -I INPUT -p udp -i br1 --dport 67:68 -j ACCEPT
# allow incoming udp net-traffic via br1, which came from src-Port-68 & going-into-Port-67, (to allow DHCP-Clients to use DHCP service)
iptables -I INPUT -p udp -i br1 --sport 68 --dport 67 -m state --state NEW -j ACCEPT
# allow incoming udp+tcp net-traffic via br1, going-into port-53, (to use DNS service)
# iptables -I INPUT -p tcp -i br1 --dport 53 -j ACCEPT
# iptables -I INPUT -p udp -i br1 --dport 53 -j ACCEPT
# allow incoming udp+tcp net-traffic via br1, which are from c.20.0/24-sunet & going-into c.20.1 port-53, (to use DNS service)
iptables -I INPUT -p tcp -i br1 -s 192.168.20.0/24 -d 192.168.20.1 --dport 53 -j ACCEPT
iptables -I INPUT -p udp -i br1 -s 192.168.20.0/24 -d 192.168.20.1 --dport 53 -j ACCEPT
# deny br1-users all pkt-forward access, into any nif+subnet which is not-br1
# iptables -I FORWARD -i br1 -m state --state NEW -o ! br1 -j DROP
# deny br1-users access, into br0 nif+subnet <-- blocks all including internet-bound pkts, so use next rule
# iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP
# deny br1-users access, into br0 subnet, but allow internet-bound traffic to pass-thru
iptables -I FORWARD -i br1 -d $(nvram get lan_ipaddr)/$(nvram get lan_netmask) -m state --state NEW -j DROP
# deny br1-users access, into br2 nif+subnet
iptables -I FORWARD -i br1 -o br2 -m state --state NEW -j DROP
# deny br1-users access, into br3 nif+subnet
iptables -I FORWARD -i br1 -o br3 -m state --state NEW -j DROP
# deny br1-users access, into br4 nif+subnet
iptables -I FORWARD -i br1 -o br4 -m state --state NEW -j DROP
# deny br1-users access, into (vpn-client's) tun1 nif+subnet
iptables -I FORWARD -i br1 -o tun1 -m state --state NEW -j DROP
# deny br1-users access, into wl0 nif+subnet
iptables -I FORWARD -i br1 -o wl0 -m state --state NEW -j DROP
# deny br1-users access, into eth1 nif+subnet
# iptables -I FORWARD -i br1 -o eth1 -m state --state NEW -j DROP
# deny br1-users access, into wl1 nif+subnet
# iptables -I FORWARD -i br1 -o wl1 -m state --state NEW -j DROP
# deny br1-users access, into eth2 nif+subnet
iptables -I FORWARD -i br1 -o eth2 -m state --state NEW -j DROP
# deny br1-users access, into wl1.1 nif+subnet
iptables -I FORWARD -i br1 -o wl1.1 -m state --state NEW -j DROP
# deny br1-users access, into wl1.2 nif+subnet
# iptables -I FORWARD -i br1 -o wl1.2 -m state --state NEW -j DROP
# deny br1-users access, into wl1.2 subnet, but allow internet-bound traffic to pass-thru
# iptables -I FORWARD -i br1 -d $(nvram get wl1.2_ipaddr)/$(nvram get wl1.2_netmask) -m state --state NEW -j DROP
# deny br1-users access, into wl1.3 nif+subnet
iptables -I FORWARD -i br1 -o wl1.3 -m state --state NEW -j DROP
# deny br1-users access, into vlan1 nif+subnet
iptables -I FORWARD -i br1 -o vlan1 -m state --state NEW -j DROP
# deny br1-users access, into vlan2 nif+subnet
iptables -I FORWARD -i br1 -o vlan2 -m state --state NEW -j DROP
# deny br1-users access, into vlan3 nif+subnet
iptables -I FORWARD -i br1 -o vlan3 -m state --state NEW -j DROP
# deny br1-users access, into vlan4 nif+subnet
# iptables -I FORWARD -i br1 -o vlan4 -m state --state NEW -j DROP
# deny br1-users access, into vlan4 subnet, but allow internet-bound traffic to pass-thru
# iptables -I FORWARD -i br1 -d $(nvram get vlan4_ipaddr)/$(nvram get vlan4_netmask) -m state --state NEW -j DROP
# deny br1-users access, into teql0 nif+subnet
iptables -I FORWARD -i br1 -o teql0 -m state --state NEW -j DROP
# send net-traffic from br1 c.20.1 into Lan-GW c.10.254 after NAT
# iptables -t nat -I POSTROUTING -o br1 -s 192.168.20.1 -j SNAT --to $(nvram get lan_gateway)
# send net-traffic from c.20.0/24 to br0 after NAT
iptables -t nat -I POSTROUTING -s 192.168.20.0/24 -o br0 -j MASQUERADE
#
#
# br2 : ip+dns+gw: c.30.1/24 : has DHCP : wl1.1+vlan3 users go thru this/br2 into br3
# send DNS/53 resolve-requests (from br2 c.30.1 subnet), into (DNSMASQ's) DNS/53-port Listening IP-addr c.30.1
# iptables -t nat -I PREROUTING -p tcp -i br2 -d 192.168.30.1 --dport 53 -j DNAT --to 192.168.30.1:53
# iptables -t nat -I PREROUTING -p udp -i br2 -d 192.168.30.1 --dport 53 -j DNAT --to 192.168.30.1:53
# Tcp+Udp net-traffic which coming via br2 for/into ip c.30.1 port-53 from c.30.0/24 subnet, send those to (DNSMASQ's) DNS/53-port Listening IP-addr c.30.1:53
# iptables -t nat -I PREROUTING -p tcp -i br2 -s 192.168.30.0/24 -d 192.168.30.1 --dport 53 -j DNAT --to 192.168.30.1:53
# iptables -t nat -I PREROUTING -p udp -i br2 -s 192.168.30.0/24 -d 192.168.30.1 --dport 53 -j DNAT --to 192.168.30.1:53
# deny incoming net-traffic (after a default wait-period), which coming via br2-nif:
# iptables -I INPUT -i br2 -j REJECT
# deny incoming net-traffic instantly, which coming from outside via br2-nif:
iptables -I INPUT -i br2 -j DROP
# allow only incoming essential router services (ICMP, DHCP/67 & DNS/53) coming via br2-nif:
# allow any icmp coming via br2
# iptables -I INPUT -p icmp -i br2 -j ACCEPT
# allow br2-subnet users to send PING/ICMP into another user in same br2-subnet only
# iptables -I INPUT -p icmp -i br2 -s 192.168.30.0/24 -d 192.168.30.0/24 -j ACCEPT
# allow incoming udp net-traffic via br2 into+for port 67 & 68, (to use DHCP)
# iptables -I INPUT -p udp -i br2 --dport 67:68 -j ACCEPT
# allow incoming udp net-traffic via br2, which came from src-Port-68 & going-into-Port-67, (to use DHCP service)
iptables -I INPUT -p udp -i br2 --sport 68 --dport 67 -m state --state NEW -j ACCEPT
# allow incoming udp+tcp net-traffic via br2, going-into port-53, (to use DNS service)
# iptables -I INPUT -p tcp -i br2 --dport 53 -j ACCEPT
# iptables -I INPUT -p udp -i br2 --dport 53 -j ACCEPT
# allow incoming udp+tcp net-traffic via br2, which are from c.30.0/24-sunet & going-into c.30.1 port-53, (to use DNS service)
# iptables -I INPUT -p tcp -i br2 -s 192.168.30.0/24 -d 192.168.30.1 --dport 53 -j ACCEPT
# iptables -I INPUT -p udp -i br2 -s 192.168.30.0/24 -d 192.168.30.1 --dport 53 -j ACCEPT
# allow incoming udp+tcp net-traffic via br2, which are from c.30.0/24-sunet & going-into VPN DNS-Srvr 10.10.5.1 port-53, (to use DNS service)
# iptables -I INPUT -p tcp -i br2 -s 192.168.30.0/24 -d 10.10.5.1 --dport 53 -j ACCEPT
# iptables -I INPUT -p udp -i br2 -s 192.168.30.0/24 -d 10.10.5.1 --dport 53 -j ACCEPT
# deny br2-users access, into br0 nif+subnet
iptables -I FORWARD -i br2 -o br0 -m state --state NEW -j DROP
# deny br2-users access, into br1 nif+subnet
iptables -I FORWARD -i br2 -o br1 -m state --state NEW -j DROP
# deny br2-users access, into br3 nif+subnet <-- blocks all including internet-bound, use next
# iptables -I FORWARD -i br2 -o br3 -m state --state NEW -j DROP
# deny br2-users access, into br3 subnet, but allow internet-bound traffic to pass-thru
iptables -I FORWARD -i br2 -d $(nvram get br3_ipaddr)/$(nvram get br3_netmask) -m state --state NEW -j DROP
# deny br2-users access, into br4 nif+subnet
iptables -I FORWARD -i br2 -o br4 -m state --state NEW -j DROP
# deny br2-users access, into wl0 nif+subnet
iptables -I FORWARD -i br2 -o wl0 -m state --state NEW -j DROP
# deny br2-users access, into eth1 nif+subnet
iptables -I FORWARD -i br2 -o eth1 -m state --state NEW -j DROP
# deny br2-users access, into wl1 nif+subnet
iptables -I FORWARD -i br2 -o wl1 -m state --state NEW -j DROP
# deny br2-users access, into eth2 nif+subnet
iptables -I FORWARD -i br2 -o eth2 -m state --state NEW -j DROP
# deny br2-users access, into wl1.1 nif+subnet
# iptables -I FORWARD -i br2 -o wl1.1 -m state --state NEW -j DROP
# deny br2-users access, into wl1.1 subnet, but allow internet-bound traffic to pass-thru
# iptables -I FORWARD -i br2 -d $(nvram get wl1.1_ipaddr)/$(nvram get wl1.1_netmask) -m state --state NEW -j DROP
# deny br2-users access, into wl1.2 nif+subnet
iptables -I FORWARD -i br2 -o wl1.2 -m state --state NEW -j DROP
# deny br2-users access, into wl1.3 nif+subnet
iptables -I FORWARD -i br2 -o wl1.3 -m state --state NEW -j DROP
# deny br2-users access, into vlan1 nif+subnet
iptables -I FORWARD -i br2 -o vlan1 -m state --state NEW -j DROP
# deny br2-users access, into vlan2 nif+subnet
iptables -I FORWARD -i br2 -o vlan2 -m state --state NEW -j DROP
# deny br2-users access, into vlan3 nif+subnet
# iptables -I FORWARD -i br2 -o vlan3 -m state --state NEW -j DROP
# deny br2-users access, into vlan3 subnet, but allow internet-bound traffic to pass-thru
# iptables -I FORWARD -i br2 -d $(nvram get vlan3_ipaddr)/$(nvram get vlan3_netmask) -m state --state NEW -j DROP
# deny br2-users access, into vlan4 nif+subnet
iptables -I FORWARD -i br2 -o vlan4 -m state --state NEW -j DROP
# deny br2-users access, into teql0 nif+subnet
iptables -I FORWARD -i br2 -o teql0 -m state --state NEW -j DROP
# allow br2-users access, to printer IP-Adrs on br3-subnet (optional rule, just as an example)
# iptables -I FORWARD -i br2 -o br3 -p tcp -d 192.168.PRINTER.IP-ADRS \
# --dport 9100 -m state --state NEW -j ACCEPT
# apply NAT on this(c.30.0/24) subnet outgoing traffic & send thru br3
iptables -t nat -I POSTROUTING -s 192.168.30.0/24 -o br3 -j MASQUERADE
#
#
# br4 : ip+dns+gw: c.32.1/24 : has DHCP : wl1.3 users go thru this/br4 into br3
# send DNS/53 resolve-requests (from br4 c.32.1 subnet), into (DNSMASQ's) DNS/53-port Listening IP-addr c.32.1
# iptables -t nat -I PREROUTING -p tcp -i br4 -d 192.168.32.1 --dport 53 -j DNAT --to 192.168.32.1:53
# iptables -t nat -I PREROUTING -p udp -i br4 -d 192.168.32.1 --dport 53 -j DNAT --to 192.168.32.1:53
# Tcp+Udp net-traffic which coming via br4 for/into ip c.32.1 port-53 from c.32.0/24 subnet, send those to (DNSMASQ's) DNS/53-port Listening IP-addr c.32.1:53
# iptables -t nat -I PREROUTING -p tcp -i br4 -s 192.168.32.0/24 -d 192.168.32.1 --dport 53 -j DNAT --to 192.168.32.1:53
# iptables -t nat -I PREROUTING -p udp -i br4 -s 192.168.32.0/24 -d 192.168.32.1 --dport 53 -j DNAT --to 192.168.32.1:53
# deny incoming net-traffic (after a default wait-period), which coming via br4-nif:
# iptables -I INPUT -i br4 -j REJECT
# deny incoming net-traffic instantly, which coming via br4-nif:
iptables -I INPUT -i br4 -j DROP
# allow only incoming essential router services (ICMP, DHCP/67 & DNS/53) coming via br4-nif:
# allow any icmp coming via br4
# iptables -I INPUT -p icmp -i br4 -j ACCEPT
# allow incoming udp net-traffic via br4 into+for port 67 & 68, (to use DHCP)
# iptables -I INPUT -p udp -i br4 --dport 67:68 -j ACCEPT
# allow incoming udp net-traffic via br4, which came from src-Port-68 & going-into-Port-67, (to use DHCP service)
iptables -I INPUT -p udp -i br4 --sport 68 --dport 67 -m state --state NEW -j ACCEPT
# allow incoming udp+tcp net-traffic via br4, going-into port-53, (to use DNS service)
# iptables -I INPUT -p tcp -i br4 --dport 53 -j ACCEPT
# iptables -I INPUT -p udp -i br4 --dport 53 -j ACCEPT
# allow incoming udp+tcp net-traffic via br4, which are from c.32.0/24-sunet & going-into c.32.1 port-53, (to use DNS service)
# iptables -I INPUT -p tcp -i br4 -s 192.168.32.0/24 -d 192.168.32.1 --dport 53 -j ACCEPT
# iptables -I INPUT -p udp -i br4 -s 192.168.32.0/24 -d 192.168.32.1 --dport 53 -j ACCEPT
# allow incoming udp+tcp net-traffic via br4, which are from c.32.0/24-sunet & going-into VPN DNS-Srvr 10.10.5.1 port-53, (to use DNS service)
# iptables -I INPUT -p tcp -i br4 -s 192.168.32.0/24 -d 10.10.5.1 --dport 53 -j ACCEPT
# iptables -I INPUT -p udp -i br4 -s 192.168.32.0/24 -d 10.10.5.1 --dport 53 -j ACCEPT
# deny br4-users access, into br0 nif+subnet
iptables -I FORWARD -i br4 -o br0 -m state --state NEW -j DROP
# deny br4-users access, into br1 nif+subnet
iptables -I FORWARD -i br4 -o br1 -m state --state NEW -j DROP
# deny br4-users access, into br2 nif+subnet
iptables -I FORWARD -i br4 -o br2 -m state --state NEW -j DROP
# deny br4-users access, into br3 nif+subnet <-- blocks all including internet-bound, use next
# iptables -I FORWARD -i br4 -o br3 -m state --state NEW -j DROP
# deny br4-users access, into br3 subnet, but allow internet-bound traffic to pass-thru
iptables -I FORWARD -i br4 -d $(nvram get br3_ipaddr)/$(nvram get br3_netmask) -m state --state NEW -j DROP
# deny br4-users access, into wl0 nif+subnet
iptables -I FORWARD -i br4 -o wl0 -m state --state NEW -j DROP
# deny br4-users access, into eth1 nif+subnet
iptables -I FORWARD -i br4 -o eth1 -m state --state NEW -j DROP
# deny br4-users access, into wl1 nif+subnet
iptables -I FORWARD -i br4 -o wl1 -m state --state NEW -j DROP
# deny br4-users access, into eth2 nif+subnet
iptables -I FORWARD -i br4 -o eth2 -m state --state NEW -j DROP
# deny br4-users access, into wl1.1 nif+subnet
iptables -I FORWARD -i br4 -o wl1.1 -m state --state NEW -j DROP
# deny br4-users access, into wl1.2 nif+subnet
iptables -I FORWARD -i br4 -o wl1.2 -m state --state NEW -j DROP
# deny br4-users access, into wl1.3 nif+subnet
# iptables -I FORWARD -i br4 -o wl1.3 -m state --state NEW -j DROP
# deny br4-users access, into wl1.3 subnet, but allow internet-bound traffic to pass-thru
# iptables -I FORWARD -i br4 -d $(nvram get wl1.3_ipaddr)/$(nvram get wl1.3_netmask) -m state --state NEW -j DROP
# deny br4-users access, into vlan1 nif+subnet
iptables -I FORWARD -i br4 -o vlan1 -m state --state NEW -j DROP
# deny br4-users access, into vlan2 nif+subnet
iptables -I FORWARD -i br4 -o vlan2 -m state --state NEW -j DROP
# deny br4-users access, into vlan3 nif+subnet
iptables -I FORWARD -i br4 -o vlan3 -m state --state NEW -j DROP
# deny br4-users access, into vlan4 nif+subnet
iptables -I FORWARD -i br4 -o vlan4 -m state --state NEW -j DROP
# deny br4-users access, into teql0 nif+subnet
iptables -I FORWARD -i br4 -o teql0 -m state --state NEW -j DROP
# allow br4-users access, to printer IP-Adrs on br3-subnet (optional rule, just as an example)
# iptables -I FORWARD -i br4 -o br3 -p tcp -d 192.168.PRINTER.IP-ADRS \
# --dport 9100 -m state --state NEW -j ACCEPT
# apply NAT on this(c.32.0/24) subnet outgoing traffic & send thru br3
iptables -t nat -I POSTROUTING -s 192.168.32.0/24 -o br3 -j MASQUERADE
#
#
# br3 : ip+gw: c.31.1/24 : has NO DHCP : br2 & br4 users go thru this/br3 into br0/gw
# deny incoming net-traffic (after a default wait-period), which coming via br3-nif:
# iptables -I INPUT -i br3 -j REJECT
# deny incoming net-traffic instantly, which coming via br3-nif:
iptables -I INPUT -i br3 -j DROP
# deny br3-users access, into br0 nif+subnet <-- blocks all including internet-bound, so use next
# iptables -I FORWARD -i br3 -o br0 -m state --state NEW -j DROP
# deny br3-users access, into br0 subnet, but allow internet-bound traffic to pass-thru
iptables -I FORWARD -i br3 -d $(nvram get lan_ipaddr)/$(nvram get lan_netmask) -m state --state NEW -j DROP
# deny br3-users access, into br1 nif+subnet
iptables -I FORWARD -i br3 -o br1 -m state --state NEW -j DROP
# deny br3-users access, into br2 nif+subnet
iptables -I FORWARD -i br3 -o br2 -m state --state NEW -j DROP
# deny br3-users access, into br4 nif+subnet
iptables -I FORWARD -i br3 -o br4 -m state --state NEW -j DROP
# deny br3-users access, into wl0 nif+subnet
iptables -I FORWARD -i br3 -o wl0 -m state --state NEW -j DROP
# deny br3-users access, into eth1 nif+subnet
iptables -I FORWARD -i br3 -o eth1 -m state --state NEW -j DROP
# deny br3-users access, into wl1 nif+subnet
iptables -I FORWARD -i br3 -o wl1 -m state --state NEW -j DROP
# deny br3-users access, into eth2 nif+subnet
iptables -I FORWARD -i br3 -o eth2 -m state --state NEW -j DROP
# deny br3-users access, into wl1.1 nif+subnet
iptables -I FORWARD -i br3 -o wl1.1 -m state --state NEW -j DROP
# deny br3-users access, into wl1.2 nif+subnet
iptables -I FORWARD -i br3 -o wl1.2 -m state --state NEW -j DROP
# deny br3-users access, into wl1.3 nif+subnet
iptables -I FORWARD -i br3 -o wl1.3 -m state --state NEW -j DROP
# deny br3-users access, into vlan1 nif+subnet
iptables -I FORWARD -i br3 -o vlan1 -m state --state NEW -j DROP
# deny br3-users access, into vlan2 nif+subnet
iptables -I FORWARD -i br3 -o vlan2 -m state --state NEW -j DROP
# deny br3-users access, into vlan3 nif+subnet
iptables -I FORWARD -i br3 -o vlan3 -m state --state NEW -j DROP
# deny br3-users access, into vlan4 nif+subnet
iptables -I FORWARD -i br3 -o vlan4 -m state --state NEW -j DROP
# deny br3-users access, into teql0 nif+subnet
iptables -I FORWARD -i br3 -o teql0 -m state --state NEW -j DROP
# allow br3-users access to printer IP-Adrs on br0-subnet (optional rule, just as an example)
# iptables -I FORWARD -i br3 -o br0 -p tcp -d 192.168.PRINTER.IP-ADRS \
# --dport 9100 -m state --state NEW -j ACCEPT
# apply NAT on this(c.31.0/24) subnet outgoing traffic & send thru br0
iptables -t nat -I POSTROUTING -s 192.168.31.0/24 -o br0 -j MASQUERADE
#
#
# tun1 : current ip: 10.10.4.0/24 <-- its dynamically obtained from VSP.
# br2 & br4 users <-> tun1 <-Encrypted-VPN-Tunnel-> br0/gw <-> RTR-1 <-> Internet <-> VSP.
# tun1 created by VPN-Client in DDWRT RTR-2, uses 10.10.5.1 DNS server in VPN-tunnel.
# deny tun1-users access, into br0 nif+subnet <-- blocks all including internet-bound, so use next
# iptables -I FORWARD -i tun1 -o br0 -m state --state NEW -j DROP
# deny tun1-users access, into br0 subnet, but allow internet-bound traffic to pass-thru
iptables -I FORWARD -i tun1 -d $(nvram get lan_ipaddr)/$(nvram get lan_netmask) -m state --state NEW -j DROP
# deny tun1-users access, into br1 nif+subnet
iptables -I FORWARD -i tun1 -o br1 -m state --state NEW -j DROP
# deny tun1-users access, into br2 nif+subnet
iptables -I FORWARD -i tun1 -o br2 -m state --state NEW -j DROP
# deny tun1-users access, into br3 nif+subnet
iptables -I FORWARD -i tun1 -o br3 -m state --state NEW -j DROP
# deny tun1-users access, into br4 nif+subnet
iptables -I FORWARD -i tun1 -o br4 -m state --state NEW -j DROP
# deny tun1-users access, into wl0 nif+subnet
iptables -I FORWARD -i tun1 -o wl0 -m state --state NEW -j DROP
# deny tun1-users access, into eth1 nif+subnet
iptables -I FORWARD -i tun1 -o eth1 -m state --state NEW -j DROP
# deny tun1-users access, into wl1 nif+subnet
iptables -I FORWARD -i tun1 -o wl1 -m state --state NEW -j DROP
# deny tun1-users access, into eth2 nif+subnet
iptables -I FORWARD -i tun1 -o eth2 -m state --state NEW -j DROP
# deny tun1-users access, into wl1.1 nif+subnet
iptables -I FORWARD -i tun1 -o wl1.1 -m state --state NEW -j DROP
# deny tun1-users access, into wl1.2 nif+subnet
iptables -I FORWARD -i tun1 -o wl1.2 -m state --state NEW -j DROP
# deny tun1-users access, into wl1.3 nif+subnet
iptables -I FORWARD -i tun1 -o wl1.3 -m state --state NEW -j DROP
# deny tun1-users access, into vlan1 nif+subnet
iptables -I FORWARD -i tun1 -o vlan1 -m state --state NEW -j DROP
# deny tun1-users access, into vlan2 nif+subnet
iptables -I FORWARD -i tun1 -o vlan2 -m state --state NEW -j DROP
# deny tun1-users access, into vlan3 nif+subnet
iptables -I FORWARD -i tun1 -o vlan3 -m state --state NEW -j DROP
# deny tun1-users access, into vlan4 nif+subnet
iptables -I FORWARD -i tun1 -o vlan4 -m state --state NEW -j DROP
# deny tun1-users access, into teql0 nif+subnet
iptables -I FORWARD -i tun1 -o teql0 -m state --state NEW -j DROP
# allow tun1-users access to printer IP-Adrs on br0-subnet (optional rule, just as an example)
# iptables -I FORWARD -i tun1 -o br0 -p tcp -d 192.168.PRINTER.IP-ADRS \
# --dport 9100 -m state --state NEW -j ACCEPT
# apply NAT on this VPN-Client/tun1(10.10.4.0/24) subnet outgoing traffic & send thru br0
# Not applying below specific rule, bcuz VPN-client apply dynamic values for tun1 aftr obtained from VSP
# iptables -t nat -I POSTROUTING -s 10.10.4.0/24 -o br0 -j MASQUERADE
#
#
# teql0 : ip/mac: :
# "ifconfig -a" command shows this exists,
# not using it so denying data access into/from our subnets in br1, br2, br3, br4, tun1
# deny teql0-users access, into br0 nif+subnet
# iptables -I FORWARD -i teql0 -o br0 -m state --state NEW -j DROP
# deny teql0-users access, into br1 nif+subnet
iptables -I FORWARD -i teql0 -o br1 -m state --state NEW -j DROP
# deny teql0-users access, into br2 nif+subnet
iptables -I FORWARD -i teql0 -o br2 -m state --state NEW -j DROP
# deny teql0-users access, into br3 nif+subnet
iptables -I FORWARD -i teql0 -o br3 -m state --state NEW -j DROP
# deny teql0-users access, into br4 nif+subnet
iptables -I FORWARD -i teql0 -o br4 -m state --state NEW -j DROP
# deny teql0-users access, into wl0 nif+subnet
# iptables -I FORWARD -i teql0 -o wl0 -m state --state NEW -j DROP
# deny teql0-users access, into eth1 nif+subnet
# iptables -I FORWARD -i teql0 -o eth1 -m state --state NEW -j DROP
# deny teql0-users access, into wl1 nif+subnet
# iptables -I FORWARD -i teql0 -o wl1 -m state --state NEW -j DROP
# deny teql0-users access, into eth2 nif+subnet
# iptables -I FORWARD -i teql0 -o eth2 -m state --state NEW -j DROP
# deny teql0-users access, into wl1.1 nif+subnet
iptables -I FORWARD -i teql0 -o wl1.1 -m state --state NEW -j DROP
# deny teql0-users access, into wl1.2 nif+subnet
iptables -I FORWARD -i teql0 -o wl1.2 -m state --state NEW -j DROP
# deny teql0-users access, into wl1.3 nif+subnet
iptables -I FORWARD -i teql0 -o wl1.3 -m state --state NEW -j DROP
# deny teql0-users access, into vlan1 nif+subnet
# iptables -I FORWARD -i teql0 -o vlan1 -m state --state NEW -j DROP
# deny teql0-users access, into vlan2 nif+subnet
# iptables -I FORWARD -i teql0 -o vlan2 -m state --state NEW -j DROP
# deny teql0-users access, into vlan3 nif+subnet
iptables -I FORWARD -i teql0 -o vlan3 -m state --state NEW -j DROP
# deny teql0-users access, into vlan4 nif+subnet
iptables -I FORWARD -i teql0 -o vlan4 -m state --state NEW -j DROP
# allow teql0-users access to printer IP-Adrs on br0-subnet (optional rule, just as an example)
# iptables -I FORWARD -i teql0 -o br0 -p tcp -d 192.168.PRINTER.IP-ADRS \
# --dport 9100 -m state --state NEW -j ACCEPT
|
now, RESULT of DDWRT-CONFIG-75 | = ✅ = working | = ❎ = not-working
1. RTR-2's vlan1 (LAN-Port#4) devices can have bridged network from RTR-1 ✅
2a. inside the rtr-2 (telnet shell) , it still can ping any net-interface's (NIF's) ip-adrs ❎
2b. but cannot ping devices/users in other subnets, like: c.20.31, c.30.49, etc ✅
-
3a. tun1 ( is created by OpenVPN-client, & it ) can resolve VSP's VPN-server
domain-name & can connect with vpn server ✅
3b. vpn-client can auto-start after "Reboot" ✅ ,
but not after "Shutdown"+"Startup" ❎ or not after "Start" of router ❎
-
4a. vlan4 wired devices (connected to br1) can obtain DHCP ✅ ip,dns,etc
from c.20.0/24 subnet.
4b. vlan4/br1 devices now have full internet-access ✅
4c. ping to an internet server, i.e: ping 9.9.9.9 -c 2 <-- succeeds ✅
4d. when i ping into a domain-name (i.e: ping dns9.quad9.net -c 2)
from vlan4/br1 devices,
ping can show the dns-resolved ip-adrs (inside a pair of braces), & ping/ICMP succeeds ✅
4e. vlan4/br1 devices can ping/access LAN & WiFi devices (i.e: c.20.38, etc )
under same subnet c.20.0/24 (br1/vlan4/wl1.2) ✅
4f. vlan4/br1 devices can ping net-interface/nif's ip-adrs c.20.1 ✅
4g. i do not want device's to be isolated/partitioned inside this br1 subnet
& that is working ✅
4h. vlan4/br1 devices cannot ping/access other devices (i.e: c.30.38, etc)
in other subnets (br2/vlan3/wl1.1/c.30.0/24, br4/wl1.3/c.32.0/24, br3/c.31.0/24) ✅
and br1 devices cannot ping/access other subnet's net-interface/nif's
ip-adrs (for example c.30.1 , c32.1 , etc ) ✅
4i. so br1 subnet net-isolation with other subnets inside same rtr is working ✅
4k. ntp connection to ntp-server's ip-adrs in internet, can succeed ✅
-
5a. wifi devices can connect & remain connected with wl1.2/br1 VAP ✅
5b. cannot ping/access lan-ip c.10.251 ✅
5c. cannot ping rtr-2 GW/c.10.254 ✅
5d. cannot ping vlan1 bridged (with br0) devices (c.10.40, etc) ✅
5e. can ping external/internet connected computers: ping 9.9.9.9 -c 2 ✅
5f. when domain-name is pinged it can display dns-resolved ip-adrs in braces,
& can also ping/ICMP to ip-adrs, i.e: ping dns9.quad9.net -c 2 ✅
-
8a. vlan3 wired devices (connected to br2) can obtain DHCP
based ip,dns,etc from c.30.0/24 subnet ✅
8b. vlan3/br2 wired devices have full internet-access ✅
devices can exit-out via VPN exit-server ✅ ✅
8c. br2/vlan3 wired-devices can ping internet server/computers
via VPN, i.e: ping 9.9.9.9 -c 2 ✅
8d. can ping into a domain-name from vlan3/br2 wired devices,
ping can dns-resolve via VPN ✅ & can show ip-adrs & ping also succeeds via VPN ✅
8e. vlan3/br2 wired devices can ping/access other devices (i.e: c.30.38 )
in same subnet (br2/vlan3/wl1.1/c.30.0/24) ❎
( but br2 wifi devices cannot ping other devices in same subnet ✅ )
8f. so device isolation/partition under same subnet is not-working ❎
8g. vlan3/br2 wired devices cannot ping other-device (i.e: c.20.46 ) in other subnet ✅
8h. vlan3/br2 wired devices can ping nif ip-adrs of other subnet (i.e: c.20.1 ) ❎
8i. so net-isolation with other subnets inside same rtr is partially-working, i think ✅
8j. ntp connection to ntp-server's ip-adrs (in internet) via vpn can succeed ✅
-
6a. wl1.1 wifi vap devices (connected with br2) can connect & remain connected with wl1.1/br2 VAP ✅
6b. can obtain DHCP based ip,dns,etc from br2 ✅
6c. cannot ping nif ip : br0/lan-ip c.10.251 , br1/c.20.1 , br2/c.30.1 , br3/c.31.1, etc ✅
6d. cannot ping rtr-2 GW/c.10.254 ✅
6e. cannot ping vlan1 bridged device c.10.40 , wl1.2 device c.20.46, etc ✅
6f. so subnet isolation is working ✅
6g. device isolation/partition inside same subnet is also working ✅
6h. can ping 9.9.9.9 via VPN ✅
6i. can dns-resolve & display ip-adrs, & ping succeeds via VPN, for dns9.quad9.net ✅
-
result of wl1.3/br4 is almost same as above wl1.1/br2 ✅
QUESTIONs:
what is the default iptables POLICY for different iptables-TABLE ? in DDWRT,
when Firewall SPI is unselected/disabled/off.
and what is the default iptables POLICY when Firewall SPI is Enabled/ON/selected ? in DDWRT
when Security > Firewall-SPI is ON/enabled,
then IS IT by-default doing All-"ACCEPT" or doing All-"DROP" ?
for those net-packets/traffic which has no iptables-rule pre-specified.
How can i apply DROP-ALL iptables POLICY for br1, br2, br4, br3, tun1, etc ?
in order to use only my-approved & specific net-traffic allowing rules,
and to keep them ISOLATED from br0 net-traffic.
the eth1(wl0) & eth2(wl1) & vlan1 are now under(interlinked-by) br0,
so How can i block all net-traffic/access from-br0 & into-br0,
by all other NIFs which are not linked with br0 ?
( i do not want any unknown or any new or any other net-traffic going/coming
into/from neither br1, br2, br4 etc
nor into/from their interlinked/used NIFs : wl1.1, wl1.2, wl1.3, vlan3, vlan4, tun1, etc )
my Security+Privacy ENHANCING objectives are:
i want to ALLOW only VERY specific STANDARD net-traffic, which are REQUIRED
for it to FUNCTION, according to my-needs specified in this thread,
so i want to BLOCK/DROP all other type of net-traffic.
EDIT : i have added more paragraphs on DDWRT's GHOST AP , & added links on iptables ,
verified rest of the results, (for br2(vlan3+wl1.1) & br4(wl1.4) results, etc),
updated the QUESTIONs-Section with more questions. |
|
