Hi,
I would appreciate if one of the many experts here could have a look at my setup and my rules and provide me with some advice in what to improve/correct.
My setup:
ISP-Router on 192.168.2.1
OpenWRT-Router on 192.168.1.1 (192.168.2.101 from the ISP-Router) and 10.1.1.0 for OpenVPN
When connected to OpenVPN, I redirect all traffic through it (list push 'redirect-gateway def1'). I only got it to work by changing my default forward rule from "DROP" to "ACCEPT", which is probably wrong, but I don't know any better.
If you need more information than this, please advise.
config rule
option target 'ACCEPT'
option proto 'tcp udp'
option family 'ipv4'
option src '*'
option dest_port '1194'
option name 'Allow Inbound VPN0'
config rule
option target 'ACCEPT'
option proto 'tcp udp'
option family 'ipv4'
option src '*'
option src_ip '10.1.1.0/24'
option dest_ip '192.168.1.0/26'
option name 'Allow Inbound VPN0 Traffic to LAN'
config rule
option target 'ACCEPT'
option proto 'tcp udp'
option family 'ipv4'
option src '*'
option src_ip '10.1.1.0/24'
option dest '*'
option dest_ip '192.168.1.0/26'
option name 'Allow Forwarded VPN0 Traffic to LAN'
config rule
option target 'ACCEPT'
option proto 'icmp'
option src_ip '10.1.1.0/24'
option src '*'
option dest 'lan'
option name 'Allow Inbound ICMP Traffic from VPN0 to LAN'
config rule
option target 'ACCEPT'
option proto 'icmp'
option src '*'
option src_ip '10.1.1.0/24'
option dest 'wan'
option name 'Allow Outbound ICMP Echo Request (8) from VPN0'
list icmp_type 'echo-request'
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option drop_invalid '1'
option forward 'ACCEPT'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option network 'lan'
option forward 'DROP'
config zone
option name 'vpn'
option input 'ACCEPT'
option forward 'ACCEPT'
option output 'ACCEPT'
option network 'vpn0'
option family 'ipv4'
config zone
option name 'wan'
option output 'ACCEPT'
option masq '1'
option mtu_fix '1'
option network 'wan wan6'
option input 'DROP'
option forward 'DROP'
config include
option path '/etc/firewall.user'
config forwarding
option dest 'wan'
option src 'lan'
config forwarding
option dest 'lan'
option src 'vpn'
config forwarding
option dest 'vpn'
option src 'lan'
