This section contains a collection of netfilter configuration examples that are difficult or impossible to provision through the fw3 application.
These rule sets will generally be added to
/etc/firewall.user and will be
parsed after the fw3 configuration. Rules added using
-A will be appended
to the end of the existing chain so may not be run if there is a prior match.
-I [rulenum] to insert the rule after rulenum in the chain (default is
adding as the first rule.)
To reiterate an earlier point, the netfilter chains can get a tricky
because the fw3 application
implicitly creates a number of them to organize rule sets.
See netfilter management
for tools to diagnose
The examples in this section explicitly use the
iptables application and
not fw3 UCI configurations.
This example uses the netfilter
limit match to forward at most 1000
packets/second from the WAN-sid to the LAN-side. After the number of packets
exceeds the limit (1000/s), a subsequent rule will be processed until the
policy (which is usually set to DROP.)
# create a new chain and append to the forwarding_wan chain iptables -N wan_forward_limit iptables -A wan_forward_limit -m limit --limit 1000/s --limit-burst 10000 -j RETURN iptables -A forwarding_wan_rule -j wan_forward_limit
For practical reasons, this rule would only used if the LAN-side network is very slow/congested (for example, a T1 ~1.5Mbit throughput).
As an example of a rule implicitly created by fw3, this rule is created when
Enable SYN-flood protection checkbox is set. This rule prevents a DDoS
syn-flood attack by limiting the number of TCP SYN packets to 25/sec. All SYN
packets after the limit are handled by a subsequent rule.
iptables -t filter -A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN