config defaults option input 'ACCEPT' option output 'ACCEPT' option forward 'REJECT' option synflood_protect '1' config zone option name 'lan' option input 'ACCEPT' option output 'ACCEPT' option forward 'ACCEPT' list network 'lan' config zone option input 'ACCEPT' option output 'ACCEPT' list network 'dmz' option name 'dmz' option forward 'ACCEPT' config zone option name 'wan' option output 'ACCEPT' option masq '1' option mtu_fix '1' option input 'REJECT' option forward 'REJECT' list network 'wan' list network 'wan6' list network 'wwan' config forwarding option src 'lan' option dest 'wan' config rule option src 'lan' list src_ip '192.168.1.23' option dest 'wan' option target 'DROP' option name 'Block Fan2' config rule option name 'Block Vacuum2' option src 'lan' list src_ip '192.168.1.22' option dest 'wan' option target 'DROP' config rule option name 'Block cam2' option src 'lan' list src_ip '192.168.1.87' option dest 'wan' option target 'DROP' config rule option name 'Allow-DHCP-Renew' option src 'wan' option proto 'udp' option dest_port '68' option target 'ACCEPT' option family 'ipv4' config rule option name 'Allow-Ping' option src 'wan' option proto 'icmp' option icmp_type 'echo-request' option family 'ipv4' option target 'ACCEPT' config rule option name 'Allow-IGMP' option src 'wan' option proto 'igmp' option family 'ipv4' option target 'ACCEPT' config rule option name 'Allow-DHCPv6' option src 'wan' option proto 'udp' option src_ip 'fc00::/6' option dest_ip 'fc00::/6' option dest_port '546' option family 'ipv6' option target 'ACCEPT' config rule option name 'Allow-MLD' option src 'wan' option proto 'icmp' option src_ip 'fe80::/10' list icmp_type '130/0' list icmp_type '131/0' list icmp_type '132/0' list icmp_type '143/0' option family 'ipv6' option target 'ACCEPT' config rule option name 'Allow-ICMPv6-Input' option src 'wan' option proto 'icmp' list icmp_type 'echo-request' list icmp_type 'echo-reply' list icmp_type 'destination-unreachable' list icmp_type 'packet-too-big' list icmp_type 'time-exceeded' list icmp_type 'bad-header' list icmp_type 'unknown-header-type' list icmp_type 'router-solicitation' list icmp_type 'neighbour-solicitation' list icmp_type 'router-advertisement' list icmp_type 'neighbour-advertisement' option limit '1000/sec' option family 'ipv6' option target 'ACCEPT' config rule option name 'Allow-ICMPv6-Forward' option src 'wan' option dest '*' option proto 'icmp' list icmp_type 'echo-request' list icmp_type 'echo-reply' list icmp_type 'destination-unreachable' list icmp_type 'packet-too-big' list icmp_type 'time-exceeded' list icmp_type 'bad-header' list icmp_type 'unknown-header-type' option limit '1000/sec' option family 'ipv6' option target 'ACCEPT' config rule option name 'Allow-IPSec-ESP' option src 'wan' option dest 'lan' option proto 'esp' option target 'ACCEPT' config rule option name 'Allow-ISAKMP' option src 'wan' option dest 'lan' option dest_port '500' option proto 'udp' option target 'ACCEPT' config rule option name 'Support-UDP-Traceroute' option src 'wan' option dest_port '33434:33689' option proto 'udp' option family 'ipv4' option target 'REJECT' option enabled '0' config include option path '/etc/firewall.user' config redirect option target 'DNAT' list proto 'tcp' option src 'wan' option src_dport '80' option name 'http' option dest_ip '172.16.0.101' option dest 'lan' config redirect option target 'DNAT' list proto 'tcp' option src 'wan' option src_dport '443' option name 'https' option dest_ip '172.16.0.101' option dest 'lan' config redirect option dest 'lan' option target 'DNAT' option name 'ssh-git' list proto 'tcp' option src 'wan' option src_dport '22' option dest_ip '172.16.0.104' config forwarding option dest 'wan' config forwarding option src 'wan' config forwarding option src 'dmz' option dest 'wan' config forwarding option src 'lan' option dest 'dmz' config rule option name 'Allow-IPSec-ESP-DMZ' list proto 'esp' option src 'wan' option dest 'dmz' option target 'ACCEPT' config rule option name 'Allow-ISAKMP-DMZ' list proto 'udp' option src 'wan' option dest 'dmz' option dest_port '500' option target 'ACCEPT' config rule option name 'external-samba-445' list proto 'tcp' option src 'dmz' list src_ip '172.16.0.101' option dest 'lan' list dest_ip '192.168.1.101' option dest_port '445' option target 'ACCEPT' config rule option name 'external-samba-139' list proto 'tcp' option src 'dmz' list src_ip '172.16.0.101' option dest 'lan' list dest_ip '192.168.1.101' option dest_port '139' option target 'ACCEPT'