[eltan]

Hi,

I am using ddwrt r20463 on a Linksys WRT160NL

I am struggling for configuring a stateful firewall using iptables since days.

Here is my configuration:
-equipment in routing mode (no NAT)
-WAN (eth1) 192.168.0.2/255.255.255.0
-LAN (br0) 192.168.1.1/255.255.255.0
- SPI firewall enabled in web interface

Here is my iptables config:

#Flush of iptables config
iptables -F

#Default policy for FW=DROP other are ALLOW
iptables -P FORWARD DROP
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT


#allow outgoing connections
iptables -I FORWARD -i br0 -o eth1 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

#allow response from the outside
iptables -I FORWARD -i eth1 -o br0 -m state --state ESTABLISHED,RELATED -j ACCEPT

With this configuration no packet are FW


Also if I change the last two lines with:

#allow outgoing connections
iptables -I FORWARD -i br0 -o eth1 -j ACCEPT

#allow response from the outside
iptables -I FORWARD -i eth1 -o br0 -m state --state ESTABLISHED,RELATED -j ACCEPT

What I notice is that the outgoing pass but the response never pass

I seems the SPI firewall is not working in ddwrt ?

Thanks for any help on this