---
title: "03 — Firewall Rules"
description: "## Purpose"
section: nanda
raw: "03-firewall-rules.md"
source: ai-generated
tags: network, aruba, siemens, vlan
last-updated: 2026-09-15
---

# 03 — Firewall Rules

> **Last updated:** 2026-09-05 | **Status:** Generated from OpenWRT backup

## Purpose

The firewall configuration extracted from the OpenWRT backup. Every rule has a zone assignment and a clear purpose.

## Firewall platform

| Item | Value |
|------|-------|
| Hardware | OpenWRT Router (Clacks) |
| Platform | LuCI + nftables backend |
| Default policy | REJECT (deny by default) |

## Zones summary

| Zone | Networks | Policy (in→out) | Forward to |
|------|----------|------------------|------------|
| lan | lan, wg0 | REJECT → ACCEPT | WAN, DMZ, HASS, MGMT |
| hass | hass | REJECT → ACCEPT | WAN only |
| dmz | dmz | REJECT → ACCEPT | WAN (port forwards) |
| guest | guest | REJECT → ACCEPT | WAN only |
| mgmt | mgmt | REJECT → ACCEPT | LAN for admin access |

## Default policies

| From → To | Default policy | Notes |
|-----------|----------------|-------|
| WAN → LAN/HASS/DMZ/MGMT | **REJECT** | All outbound from zones allowed |
| Any zone → WAN (forward) | **REJECT** | Hairpin NAT exceptions exist |
| LAN ↔ Internal | ACCEPT (except explicit deny) | Normal local traffic |

## Port forwarding / DNAT summary

| From zone | To IP:port/service | Protocol | Purpose |
|-----------|--------------------|----------|---------|
| wan → dmz | 192.168.31.5:443/80/53 | TCP/UDP | HTTPS, HTTP, DNS (AdGuard) |
| wan → lan | 192.168.30.1:32400 | TCP | Plex media server |
| wan → dmz | 192.168.31.3:123/4460 | UDP/TCP | NTP, NewPipe Streamer |
| wan → hass | 192.168.29.254:123/53 | UDP | Home Assistant NTP/DNS |
| wan → dmz/hass | 192.168.31.253:51820 | UDP | WireGuard VPN (WG-WAN-DMZ) |
| hass → lan | 192.168.29.254:51821 | UDP | WireGuard loopback |

## Allowed inbound ICMP

| Rule | From | To zone | ICMP types | Rate limit |
|------|------|---------|-----------|------------|
| Allow-Ping | wan → wan | — | echo-request/reply | — |
| Allow-IGMP | wan → all zones | IGMP joins | — | — |

## Allowed inbound ports (all zones)

- DHCP server port 68/udp (DHCP renewals)
- NTP port 123/udp everywhere  
- DNS port 53/udp everywhere

## DMZ-specific inbound rules

Only these services are accessible from WAN:

- Port 53, 80, 443 to AdGuard DNS proxy
- Port 123 (NTP), 4460 (NewPipe)
- WireGuard port 51820

## MGMT zone rules (192.168.28.0/24 only)

From mgmt subnet:

- SSH to router: port 22
- HTTP (LuCI UI): port 80
- Zabbix agent: port 10050
- AdGuard UI: port 3000

## LAN internal forwarding

| Source zone | Destination zone | Rule |
|-------------|------------------|------|
| lan → wan/dmz/hass/mgmt | All forwardable zones | ACCEPT |
| dmz → wan | External services | ACCEPT |
| guest → wan | Guest internet access | ACCEPT |

## Change log

| Date | Change | Why |
|------|--------|-----|
| 2026-09-05 | Generated from OpenWRT backup analysis | — |

## Related

- [01 — Architecture](/nanda/01-architecture/)
- [04 — IP Addressing](/nanda/04-ip-addressing/)

---

## Source Disclaimer

- [x] AI Generated
- [ ] Human Generated
- [ ] AI Edited
- [ ] Human Edited