This is how to only route whitelisted IPs on OpenWRT:
- First decide where to restrict access. I created an extra vlan with one switch port.
- Then create an “interface” with that vlan in it.
- Assign a static ip and a netmask to the vlan interface.
- Go to the “Firewall Settings” tab and create a new zone.
- Enable Masquerading for the zone.
- You could now “Allow forward to destination zone: wan” to allow all internet traffic.
- But we will rather go to “Network->Firewall->Traffic Rules” and create rules from our zone to wan for some IPs.
- Be aware that the default for traffic rules is to only allow tcp+udp.
- Now just set the destination address.
- And we are good to go.
That was complicated, wasn’t it? Well, let’s look at the config diff between our router and a fresh openwrt setup. Wow, that’s messy. Unfortunately changes in lucy lead to a complete reparse and rewrite of the default config. I went through the diff and these are the interesting bits:
diff --git a/config/firewall b/config/firewall index 7be01d2..28391ab 100644 --- a/config/firewall +++ b/config/firewall @@ -183,6 +183,20 @@ config rule # option dest_port 120 # option proto tcp # option target REJECT +config zone + option name 'limited' + option input 'ACCEPT' + option forward 'REJECT' + option output 'ACCEPT' + option network 'limited_lan' + +config rule + option target 'ACCEPT' + option src 'limited' + option dest 'wan' + option name 'berlin-ccc-dns' + option proto 'all' + option dest_ip '213.73.91.35' #config redirect # option src lan diff --git a/config/network b/config/network index e15871a..737cfb2 100644 --- a/config/network +++ b/config/network @@ -33,10 +33,21 @@ config switch config switch_vlan option device 'switch0' option vlan '1' - option ports '1 2 3 4 5t' + option ports '1 2 3 5t' config switch_vlan option device 'switch0' option vlan '2' option ports '0 5t' +config switch_vlan + option device 'switch0' + option ports '4 5t' + option vlan '42' + +config interface 'limited_lan' + option proto 'static' + option ifname 'eth0.42' + option ipaddr '10.23.42.1' + option netmask '255.255.255.0' +
