
config defaults 'defaults'
	option syn_flood '0'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option disabled '0'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option cwmp_natiface_alias 'lan'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	list network 'wanb'
	list network 'wanb6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	option cwmp_natiface_alias 'wan'

config forwarding 'lan_to_wan_forwarding'
	option src 'lan'
	option dest 'wan'

config rule 'Allow_WAN_Ping'
	option name 'Allow-WAN-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'any'
	option target 'ACCEPT'
	option cwmp_FirewallChainRule_alias 'Allow-WAN-Ping'

config rule 'Allow_WAN_DHCP'
	option name 'Allow-WAN-DHCP'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option family 'ipv4'
	option target 'ACCEPT'

config rule 'Allow_DHCPv6'
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'
	option cwmp_FirewallChainRule_alias 'Allow-DHCPv6'

config rule 'Allow_MLD'
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'
	option enabled '0'
	option cwmp_FirewallChainRule_alias 'Allow-MLD'

config rule 'Allow_ICMPv6_Input'
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option family 'ipv6'
	option target 'ACCEPT'
	option cwmp_FirewallChainRule_alias 'Allow-ICMPv6-Input'

config include 'user'
	option path '/etc/firewall.user'

config include 'ddos'
	option path '/etc/firewall.ddos'
	option reload '1'
	option ddos_enabled '1'
	option tcp_flood_enabled '1'
	option tcp_flood_rate '25'
	option tcp_flood_burst '50'
	option udp_flood_enabled '0'
	option udp_flood_rate '0'
	option udp_flood_burst '0'
	option icmp_flood_enabled '1'
	option icmp_flood_rate '100'
	option icmp_flood_burst '100'
	option port_scan_enabled '0'
	option port_scan_rate '0'
	option port_scan_burst '0'
	option tcp_flag_scan_enabled '1'
	option land_enabled '0'
	option smurf_enabled '0'
	option ping_of_death_enabled '0'
	option trace_route_enabled '0'
	option icmp_fragment_enabled '0'
	option syn_fragment_enabled '0'
	option fraggle_attack_enabled '0'
	option unknown_protocol_enabled '1'

config include 'dscp'
	option path '/etc/firewall.dscp'

config include 'fpd'
	option type 'script'
	option path '/etc/firewall.fpd'
	option family 'any'
	option reload '1'

config include 'dnsmasq'
	option path '/etc/firewall.dnsmasq'
	option type 'script'
	option family 'any'
	option reload '1'

config include 'alg'
	option path '/etc/firewall.alg'
	option reload '1'
	option l2tp '1'
	option ipsec '1'

config include 'pc'
	option type 'script'
	option path '/etc/firewall.pc'
	option family 'any'
	option reload '1'

config include 'mwan3'
	option path '/etc/firewall.mwan3'

config include 'access_website'
	option type 'script'
	option path '/etc/firewall.accessgui'
	option family 'any'
	option reload '1'

config rule 'Allow_WAN_IPv4_TR069'
	option name 'Allow-WAN-IPv4-TR069'
	option proto 'tcp udp'
	option src 'wan'
	option dest_port '7547'
	option target 'ACCEPT'
	option family 'ipv4'
	option cwmp_FirewallChainRule_alias 'Allow-WAN-IPv4-TR069'

config rule 'Reject_LAN_IPv4_TR069'
	option name 'Reject-LAN-IPv4-TR069'
	option proto 'tcp udp'
	option src 'lan'
	option dest_port '7547'
	option target 'REJECT'
	option family 'ipv4'
	option cwmp_FirewallChainRule_alias 'Reject-LAN-IPv4-TR069'
	option enabled '0'

config ipset '_sys_ipset_block_all'
	option enabled '1'
	option name 'website_block_all'
	option family 'ipv4'
	option storage 'hash'
	option match 'dest_ip'
	option maxelem '1024'

config rule '_sys_rule_block_all'
	option enabled '1'
	option name 'website_block_all'
	option family 'ipv4'
	option proto 'tcp'
	option src 'lan'
	option dest 'wan'
	option dest_port '80 443'
	option ipset 'website_block_all'
	option target 'REJECT'

config rule 'Allow_LAN_Ping'
	option name 'Allow-LAN-Ping'
	option src 'lan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'any'
	option target 'ACCEPT'
	option cwmp_FirewallChainRule_alias 'Allow-LAN-Ping'

config rule 'Allow_WAN_IPv6_TR069'
	option name 'Allow-WAN-IPv6-TR069'
	option proto 'tcp udp'
	option src 'wan'
	option dest_port '7547'
	option target 'ACCEPT'
	option family 'ipv6'
	option cwmp_FirewallChainRule_alias 'Allow-WAN-IPv6-TR069'

config rule 'Allow_WAN_LAN_IPv6_TR069'
	option name 'Allow-WAN-LAN-IPv6-TR069'
	option proto 'tcp udp'
	option src 'wan'
	option dest 'lan'
	option dest_port '7547'
	option target 'ACCEPT'
	option family 'ipv6'
	option cwmp_FirewallChainRule_alias 'Allow-WAN-LAN-IPv6-TR069'

config rule 'Allow_LAN_IPv6_TR069'
	option name 'Allow-LAN-IPv6-TR069'
	option proto 'tcp udp'
	option src 'lan'
	option dest_port '7547'
	option target 'ACCEPT'
	option family 'ipv6'
	option cwmp_FirewallChainRule_alias 'Allow-LAN-IPv6-TR069'

config rule 'Reject_WAN_SSH'
	option name 'Reject-WAN-SSH'
	option src 'wan'
	option proto 'tcp'
	option dest_port '22'
	option family 'any'
	option target 'REJECT'
	option cwmp_FirewallChainRule_alias 'Reject-WAN-SSH'

config rule 'Reject_LAN_SSH'
	option name 'Reject-LAN-SSH'
	option src 'lan'
	option proto 'tcp'
	option dest_port '22'
	option family 'any'
	option enabled '0'
	option cwmp_FirewallChainRule_alias 'Reject-LAN-SSH'
	option target 'ACCEPT'

config rule 'Allow_LAN_HTTP_80'
	option name 'Allow-LAN-HTTP-80'
	option src 'lan'
	option proto 'tcp'
	option dest_port '80'
	option target 'ACCEPT'
	option family 'any'
	option cwmp_FirewallChainRule_alias 'Allow-LAN-HTTP-80'

config rule 'Allow_LAN_HTTP_8080'
	option name 'Allow-LAN-HTTP-8080'
	option src 'lan'
	option proto 'tcp'
	option dest_port '8080'
	option target 'ACCEPT'
	option family 'any'
	option cwmp_FirewallChainRule_alias 'Allow-LAN-HTTP-8080'

config rule 'Allow_LAN_HTTPS_443'
	option name 'Allow-LAN-HTTPS-443'
	option src 'lan'
	option proto 'tcp'
	option dest_port '443'
	option target 'ACCEPT'
	option family 'any'
	option cwmp_FirewallChainRule_alias 'Allow-LAN-HTTPS-443'

config rule 'Reject_LAN_QUIC'
	option name 'Reject_LAN_QUIC'
	option src 'lan'
	option proto 'udp'
	option dest_port '443'
	option target 'REJECT'
	option family 'any'
	option cwmp_FirewallChainRule_alias 'Reject-LAN-QUIC'

config rule 'Allow_LAN_DNSProxy'
	option name 'Allow-LAN-DNSProxy'
	option src 'lan'
	option dest_port '53'
	option target 'ACCEPT'
	option family 'any'
	option proto 'tcp udp'
	option cwmp_FirewallChainRule_alias 'Allow-LAN-DNSProxy'

config rule 'Reject_LAN_SAMBA_139'
	option name 'Reject-LAN-SAMBA-139'
	option src 'lan'
	option dest_port '139'
	option target 'REJECT'
	option family 'any'
	option proto 'tcp udp'
	option cwmp_FirewallChainRule_alias 'Reject-LAN-SAMBA-139'

config rule 'Reject_LAN_SAMBA_445'
	option name 'Reject-LAN-SAMBA-445'
	option src 'lan'
	option dest_port '445'
	option target 'REJECT'
	option family 'any'
	option proto 'tcp udp'
	option cwmp_FirewallChainRule_alias 'Reject-LAN-SAMBA-445'

config rule 'Reject_LAN_NetBIOS'
	option name 'Reject-LAN-NetBIOS'
	option src 'lan'
	option dest_port '137'
	option target 'REJECT'
	option family 'any'
	option proto 'tcp udp'
	option cwmp_FirewallChainRule_alias 'Reject-LAN-NetBIOS'

config rule 'Reject_LAN_SIP_5060'
	option name 'Reject-LAN-SIP-5060'
	option src 'lan'
	option dest_port '5060'
	option target 'REJECT'
	option family 'any'
	option proto 'tcp udp'
	option cwmp_FirewallChainRule_alias 'Reject-LAN-SIP-5060'

config rule 'Reject_LAN_SIP_5061'
	option name 'Reject-LAN-SIP-5061'
	option src 'lan'
	option dest_port '5061'
	option target 'REJECT'
	option family 'any'
	option proto 'tcp udp'
	option cwmp_FirewallChainRule_alias 'Reject-LAN-SIP-5061'

config rule 'Allow_LAN_UPNP'
	option name 'Allow-LAN-UPNP'
	option src 'lan'
	option dest_port '1900'
	option target 'ACCEPT'
	option family 'any'
	option proto 'tcp udp'
	option cwmp_FirewallChainRule_alias 'Allow-LAN-UPNP'

config rule 'Allow_LAN_NTP'
	option name 'Allow-LAN-NTP'
	option src 'lan'
	option dest_port '123'
	option target 'ACCEPT'
	option family 'any'
	option proto 'tcp udp'
	option cwmp_FirewallChainRule_alias 'Allow-LAN-NTP'

config include 'ra_flood'
	option path '/etc/firewall.ra_flood'
	option type 'script'
	option family 'ipv6'

config include 'lan_to_local_guest'
	option type 'script'
	option path '/etc/firewall.lan_to_local_guest'
	option family 'any'
	option reload '1'

config include 'opennds'
	option type 'script'
	option path '/usr/lib/opennds/restart.sh'
	option family 'any'
	option reload '1'

config include 'pause_net'
	option type 'script'
	option path '/etc/firewall.pause_net'
	option family 'any'
	option reload '1'

config redirect 'dmz_v4'
	option name 'dmz_v4'
	option enabled '0'
	option cwmp_natport_alias 'dmz_v4'

config redirect 'dmz_v6'
	option name 'dmz_v6'
	option enabled '0'
	option cwmp_natport_alias 'dmz_v6'

config include 'qcanssecm'
	option type 'script'
	option path '/etc/firewall.d/qca-nss-ecm'
	option family 'any'
	option reload '1'

config include 'miniupnpd'
	option type 'script'
	option path '/usr/share/miniupnpd/firewall.include'
	option family 'any'
	option reload '1'

config include 'uhttpd'
	option type 'script'
	option path '/etc/firewall.remotegui'
	option family 'any'
	option reload '1'

config include 'dmz'
	option type 'script'
	option path '/etc/firewall.dmz'
	option family 'any'
	option reload '1'

