HUAWEI HG556A OPENWRT BARRIER BREAKER – FIREWALL

    No entraremos en profundidad en el firewall, debido a su extensión y complejidad. Ya dedicaré algunas entradas en un futuro, por ello doy directamente el fichero de configuración, que se localiza en /etc/config/firewall.

config defaults
       option syn_flood '1'
       option input 'ACCEPT'
       option output 'ACCEPT'
       option forward 'ACCEPT'
config zone
       option name 'lan'
       option input 'ACCEPT'
       option output 'ACCEPT'
       option forward 'ACCEPT'
       option network ' '
       option masq '1'
       option mtu_fix '1'
config zone
       option name 'wan'
       option output 'ACCEPT'
       option masq '1'
       option mtu_fix '1'
       option input 'ACCEPT'
       option forward 'ACCEPT'
       option network 'Wan6in4 lan wan'
config rule
       option name 'Allow-DHCP-Renew'
       option src 'wan'
       option proto 'udp'
       option dest_port '68'
       option target 'ACCEPT'
       option family 'ipv4'
config rule
       option name 'Allow-Ping'
       option src 'wan'
       option proto 'icmp'
       option icmp_type 'echo-request'
       option family 'ipv4'
       option target 'ACCEPT'
config rule
       option name 'Allow-DHCPv6'
       option src 'wan'
       option proto 'udp'
       option src_ip 'fe80::/10'
       option src_port '547'
       option dest_ip 'fe80::/10'
       option dest_port '546'
       option family 'ipv6'
       option target 'ACCEPT'
config rule
       option name 'Allow-ICMPv6-Input'
       option src 'wan'
       option proto 'icmp'
       list icmp_type 'echo-request'
       list icmp_type 'echo-reply'
       list icmp_type 'destination-unreachable'
       list icmp_type 'packet-too-big'
       list icmp_type 'time-exceeded'
       list icmp_type 'bad-header'
       list icmp_type 'unknown-header-type'
       list icmp_type 'router-solicitation'
       list icmp_type 'neighbour-solicitation'
       list icmp_type 'router-advertisement'
       list icmp_type 'neighbour-advertisement'
       option limit '1000/sec'
       option family 'ipv6'
       option target 'ACCEPT'
config rule
       option name 'Allow-ICMPv6-Forward'
       option src 'wan'
       option dest '*'
       option proto 'icmp'
       list icmp_type 'echo-request'
       list icmp_type 'echo-reply'
       list icmp_type 'destination-unreachable'
       list icmp_type 'packet-too-big'
       list icmp_type 'time-exceeded'
       list icmp_type 'bad-header'
       list icmp_type 'unknown-header-type'
       option limit '1000/sec'
       option family 'ipv6'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config forwarding
option dest 'wan'
option src 'lan'

Casi tenemos casi listo nuestro equipo, ahora nos falta algo importante, configurar el  RADVD, un poco más de paciencia.