Organizing OpenWrt Interfaces and Firewall Zones

OpenWrt firewall policy is applied through zones. A zone contains one or more logical networks; forwarding controls traffic between zones.

1. Back up and identify the backend

sysupgrade -b /tmp/firewall-network-backup.tar.gzcp /etc/config/firewall /tmp/firewall.beforecp /etc/config/network /tmp/network.beforeubus call system boarduci show firewalluci show network

Newer releases commonly use firewall4/nftables; older releases may use firewall3/iptables. Do not mix configuration or inspection commands without checking the release.

2. Understand the baseline

Typical policy boundaries are lan (trusted management), wan (outside), and guest (untrusted Internet-only). Inspect existing sections before adding duplicates:

uci show firewall | grep -E 'zone|forwarding|rule'fw4 print 2>/dev/null || iptables-save

3. Define a guest zone

Only do this after the guest logical interface exists in /etc/config/network:

config zone        option name 'guest'        list network 'guest'        option input 'REJECT'        option output 'ACCEPT'        option forward 'REJECT'config forwarding        option src 'guest'        option dest 'wan'

If a zone already exists, edit that section instead of creating a duplicate.

4. Permit only DHCP and DNS to the router

config rule        option name 'Guest-DHCP'        option src 'guest'        option proto 'udp'        option dest_port '67-68'        option target 'ACCEPT'config rule        option name 'Guest-DNS'        option src 'guest'        option proto 'tcp udp'        option dest_port '53'        option target 'ACCEPT'

These rules are intentionally narrow; do not replace them with a broad input ACCEPT.

5. Block management LAN access

For the sample LAN subnet:

config rule        option name 'Reject-Guest-to-LAN'        option src 'guest'        option dest 'lan'        option dest_ip '192.168.1.0/24'        option target 'REJECT'

If the site has other management subnets, cover each boundary deliberately.

6. Review, apply, and inspect

uci changes firewalluci show firewalluci revert firewall       # use this before commit if wronguci commit firewall/etc/init.d/firewall reloadfw4 printnft list rulesetiptables-save             # older firewall3 systems

7. Test positive and negative paths

From a guest client verify an address, gateway, DNS, and Internet access:

ip addrip routenslookup openwrt.org 192.168.20.1ping -c 3 1.1.1.1

Then verify that 192.168.1.1, NAS, switch management, and LAN SSH are unreachable. Do not expose LuCI or SSH through a broad WAN ACCEPT rule.

8. Recover

Keep console/LAN recovery when changing policy remotely. If reload locks you out:

cp /tmp/firewall.before /etc/config/firewalluci commit firewall/etc/init.d/firewall restart

{{< ads >}}

Source

Source: OpenWrt Firewall and network interfaces.