OpenWrt Firewall and Zone-Based Filtering

Zones: the building blocks

A firewall zone is a named group of one or more interfaces. Rules are written between zones rather than between individual interfaces, which keeps the configuration manageable as your network grows.

OpenWrt ships with two zones: lan (the local network) and wan (the internet). When you add a guest or IoT network, create a new zone for it and define how it relates to the others.

• lan: trusted local devices, full access to the router.
• wan: untrusted internet, blocks incoming connections by default.
• guest: untrusted local devices, internet only, no LAN access.

Zone policies: input, output, forward

Each zone has three policy settings. Input controls traffic destined for the router itself (for example SSH or DNS from that zone). Output controls traffic the router initiates into the zone. Forward controls traffic passing through the router between zones, for example from lan to wan.

The safe defaults are: lan input accept, lan output accept, lan forward accept; wan input reject, wan output accept, wan forward reject.

• Input accept: devices in the zone can reach the router's services (SSH, DNS).
• Input reject: devices cannot reach the router directly.
• Forward reject: traffic is not forwarded into or out of this zone.

Forwarding between zones

A forwarding rule lets traffic pass from one zone to another. The default rule allows lan → wan forwarding so your devices can reach the internet. There is no wan → lan forwarding, so unsolicited inbound traffic is blocked.

For a guest network, allow guest → wan forwarding but do not allow guest → lan. This gives guests internet access without letting them see your private devices.

uci add firewall forwarding
uci set firewall.@forwarding[-1].src='guest'
uci set firewall.@forwarding[-1].dest='wan'
uci commit firewall
fw4 reload

Adds a forwarding rule from the guest zone to the wan zone using the nftables-based fw4 firewall.

Traffic rules for specific ports

Traffic rules filter individual connections. They are used to allow a specific service through, such as letting the guest zone use the router's DNS server, or to block a device from the internet.

Each rule has a source zone, an optional source IP, a destination zone or IP, a port and a protocol. The action can be accept, drop or reject.

• Allow guest → router DNS: source guest, destination zone router, port 53, accept.
• Block a device: source IP the device, destination zone wan, drop.
• Never open ports to the wan zone unless you understand the risk.

Port forwarding (DNAT)

A port forward lets an external client reach a service on your LAN. In LuCI, go to Network → Firewall → Port Forwards and add a rule: set the external port, the internal IP and port, and the protocol.

OpenWrt creates both the DNAT rule (to redirect the packet) and a corresponding traffic rule (to allow the forwarded connection). Only forward ports you genuinely need, and prefer using a VPN for remote access instead of exposing services directly.

uci add firewall redirect
uci set firewall.@redirect[-1].name='HTTPS to web server'
uci set firewall.@redirect[-1].src='wan'
uci set firewall.@redirect[-1].src_dport='443'
uci set firewall.@redirect[-1].dest='lan'
uci set firewall.@redirect[-1].dest_ip='192.168.1.50'
uci set firewall.@redirect[-1].dest_port='443'
uci set firewall.@redirect[-1].proto='tcp'
uci commit firewall
fw4 reload

Forwards WAN port 443 to 192.168.1.50:443 on the LAN.

IPv6 firewall considerations

IPv6 gives every device a public address, so the firewall is even more important. The default OpenWrt IPv6 firewall blocks all inbound connections to the LAN, which is the right starting point.

To expose an IPv6 service, add a traffic rule (not a redirect) allowing the specific port to the device's IPv6 address. Avoid blanket "allow all from wan" rules on IPv6.