🎈 Sync 2026-09-30 10:37:56

firewall/files/firewall.config

@@ -1,9 +1,10 @@
 config defaults
 	option synflood_protect	1
-	option input		ACCEPT
+	option input		REJECT
 	option output		ACCEPT
 	option forward		REJECT
-	option fullcone		0
+	option flow_offloading	1
+	option fullcone		1
 # Uncomment this line to disable ipv6 rules
 #	option disable_ipv6	1
 
@@ -55,13 +56,12 @@ config rule
 	option target		ACCEPT
 
 # Allow DHCPv6 replies
-# see https://dev.openwrt.org/ticket/10381
+# see https://github.com/openwrt/openwrt/issues/5066
 config rule
 	option name		Allow-DHCPv6
 	option src		wan
 	option proto		udp
-	option src_ip		fc00::/6
-	option dest_ip		fc00::/6
+	option dest_ip		fe80::/10
 	option dest_port	546
 	option family		ipv6
 	option target		ACCEPT
@@ -82,7 +82,7 @@ config rule
 config rule
 	option name		Allow-ICMPv6-Input
 	option src		wan
-	option proto		icmp
+	option proto	icmp
 	list icmp_type		echo-request
 	list icmp_type		echo-reply
 	list icmp_type		destination-unreachable
@@ -141,7 +141,7 @@ config rule
 	option proto		udp
 	option family		ipv4
 	option target		REJECT
-	option enabled		false
+	option enabled		0
 
 # include a file with users custom iptables rules
 config include

firewall/files/firewall.init

@@ -4,17 +4,6 @@ START=19
 USE_PROCD=1
 QUIET=""
 
-LOCK_FILE="/var/lock/procd_firewall.lock"
-set_lock() {
-	exec 1000>"$LOCK_FILE"
-	flock -xn 1000
-}
-
-unset_lock() {
-	flock -u 1000
-	rm -rf "$LOCK_FILE"
-}
-
 validate_firewall_redirect()
 {
 	uci_validate_section firewall redirect "${1}" \
@@ -41,39 +30,27 @@ validate_firewall_rule()
 
 service_triggers() {
 	procd_add_reload_trigger firewall	
-	set_lock
 
 	procd_open_validate
 	validate_firewall_redirect
 	validate_firewall_rule
 	procd_close_validate
-	unset_lock
 }
 
 restart() {
-	unset_lock
-	set_lock
 	fw3 restart
-	unset_lock
 }
 
 start_service() {
-	set_lock
 	fw3 ${QUIET} start
-	unset_lock
 }
 
 stop_service() {
 	fw3 flush
-	unset_lock
 }
 
 reload_service() {
-  unset_lock
-  set_lock
-	reload_config firewall
 	fw3 reload
-	unset_lock
 }
 
 boot() {