docs.na.id.au

Purpose

03 — Firewall Rules

Last updated: 2026-09-05 | Status: Generated from OpenWRT backup

Purpose

The firewall configuration extracted from the OpenWRT backup. Every rule has a zone assignment and a clear purpose.

Firewall platform

ItemValue
HardwareOpenWRT Router (Clacks)
PlatformLuCI + nftables backend
Default policyREJECT (deny by default)

Zones summary

ZoneNetworksPolicy (in→out)Forward to
lanlan, wg0REJECT → ACCEPTWAN, DMZ, HASS, MGMT
hasshassREJECT → ACCEPTWAN only
dmzdmzREJECT → ACCEPTWAN (port forwards)
guestguestREJECT → ACCEPTWAN only
mgmtmgmtREJECT → ACCEPTLAN for admin access

Default policies

From → ToDefault policyNotes
WAN → LAN/HASS/DMZ/MGMTREJECTAll outbound from zones allowed
Any zone → WAN (forward)REJECTHairpin NAT exceptions exist
LAN ↔ InternalACCEPT (except explicit deny)Normal local traffic

Port forwarding / DNAT summary

From zoneTo IP:port/serviceProtocolPurpose
wan → dmz192.168.31.5:443/80/53TCP/UDPHTTPS, HTTP, DNS (AdGuard)
wan → lan192.168.30.1:32400TCPPlex media server
wan → dmz192.168.31.3:123/4460UDP/TCPNTP, NewPipe Streamer
wan → hass192.168.29.254:123/53UDPHome Assistant NTP/DNS
wan → dmz/hass192.168.31.253:51820UDPWireGuard VPN (WG-WAN-DMZ)
hass → lan192.168.29.254:51821UDPWireGuard loopback

Allowed inbound ICMP

RuleFromTo zoneICMP typesRate limit
Allow-Pingwan → wan—echo-request/reply—
Allow-IGMPwan → all zonesIGMP joins——

Allowed inbound ports (all zones)

DMZ-specific inbound rules

Only these services are accessible from WAN:

MGMT zone rules (192.168.28.0/24 only)

From mgmt subnet:

LAN internal forwarding

Source zoneDestination zoneRule
lan → wan/dmz/hass/mgmtAll forwardable zonesACCEPT
dmz → wanExternal servicesACCEPT
guest → wanGuest internet accessACCEPT

Change log

DateChangeWhy
2026-09-05Generated from OpenWRT backup analysis—

Source Disclaimer