root@OpenWrt:~# netstat -apn
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 999/uhttpd
tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN 1151/dnsmasq
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 960/dropbear
tcp 0 3573 192.168.0.101:22 192.168.0.38:62674 LAST_ACK -
tcp 0 300 192.168.43.189:22 192.168.43.51:62816 ESTABLISHED 1736/dropbear
tcp 0 0 192.168.43.189:58419 83.9.164.233:1723 ESTABLISHED 1326/pppd
tcp 0 3677 192.168.0.101:22 192.168.0.38:62691 LAST_ACK -
tcp 0 0 :::80 :::* LISTEN 999/uhttpd
tcp 0 0 :::53 :::* LISTEN 1151/dnsmasq
tcp 0 0 :::22 :::* LISTEN 960/dropbear
udp 0 0 0.0.0.0:53 0.0.0.0:* 1151/dnsmasq
udp 0 0 :::53 :::* 1151/dnsmasq
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node PID/Program name Path
unix 2 [ ACC ] STREAM LISTENING 279 498/ubusd /var/run/ubus.sock
unix 7 [ ] DGRAM 1076 873/logd /dev/log
unix 2 [ ACC ] STREAM LISTENING 3810 1326/pppd /var/run/pptp/83.9.164.233:1
unix 2 [ ] DGRAM 2031 1202/wpa_supplicant /var/run/wpa_supplicant/wlan0
unix 3 [ ] STREAM CONNECTED 304 498/ubusd /var/run/ubus.sock
unix 3 [ ] STREAM CONNECTED 303 1/procd
unix 2 [ ] DGRAM 1866 1151/dnsmasq
unix 3 [ ] STREAM CONNECTED 1078 873/logd
unix 3 [ ] STREAM CONNECTED 1159 498/ubusd /var/run/ubus.sock
unix 3 [ ] STREAM CONNECTED 3922 1326/pppd /var/run/pptp/83.9.164.233:1
unix 3 [ ] STREAM CONNECTED 1158 915/netifd
unix 3 [ ] STREAM CONNECTED 1079 498/ubusd /var/run/ubus.sock
unix 3 [ ] STREAM CONNECTED 1429 999/uhttpd
unix 2 [ ] DGRAM 1231 960/dropbear
unix 2 [ ] DGRAM 1469 915/netifd
unix 2 [ ] DGRAM 1509 915/netifd
unix 2 [ ] DGRAM 3765 1324/pppd
unix 3 [ ] STREAM CONNECTED 1430 498/ubusd /var/run/ubus.sock
unix 3 [ ] STREAM CONNECTED 1095 882/rpcd
unix 2 [ ] DGRAM 1170 1/procd
unix 3 [ ] STREAM CONNECTED 3772 1324/pppd
unix 3 [ ] STREAM CONNECTED 1096 498/ubusd /var/run/ubus.sock
root@OpenWrt:~# uci show firewall
firewall.@defaults[0]=defaults
firewall.@defaults[0].syn_flood='1'
firewall.@defaults[0].input='ACCEPT'
firewall.@defaults[0].output='ACCEPT'
firewall.@defaults[0].forward='ACCEPT'
firewall.@zone[0]=zone
firewall.@zone[0].name='lan'
firewall.@zone[0].input='ACCEPT'
firewall.@zone[0].output='ACCEPT'
firewall.@zone[0].forward='ACCEPT'
firewall.@zone[0].network='lan'
firewall.@zone[1]=zone
firewall.@zone[1].name='wan'
firewall.@zone[1].input='ACCEPT'
firewall.@zone[1].output='ACCEPT'
firewall.@zone[1].forward='ACCEPT'
firewall.@zone[1].masq='1'
firewall.@zone[1].mtu_fix='1'
firewall.@zone[1].network='wan wan6 wwan'
firewall.@rule[0]=rule
firewall.@rule[0].name='Allow-DHCP-Renew'
firewall.@rule[0].src='wan'
firewall.@rule[0].proto='udp'
firewall.@rule[0].dest_port='68'
firewall.@rule[0].target='ACCEPT'
firewall.@rule[0].family='ipv4'
firewall.@rule[1]=rule
firewall.@rule[1].name='Allow-Ping'
firewall.@rule[1].src='wan'
firewall.@rule[1].proto='icmp'
firewall.@rule[1].icmp_type='echo-request'
firewall.@rule[1].family='ipv4'
firewall.@rule[1].target='ACCEPT'
firewall.@rule[2]=rule
firewall.@rule[2].name='Allow-IGMP'
firewall.@rule[2].src='wan'
firewall.@rule[2].proto='igmp'
firewall.@rule[2].family='ipv4'
firewall.@rule[2].target='ACCEPT'
firewall.@rule[3]=rule
firewall.@rule[3].name='Allow-DHCPv6'
firewall.@rule[3].src='wan'
firewall.@rule[3].proto='udp'
firewall.@rule[3].src_ip='fe80::/10'
firewall.@rule[3].src_port='547'
firewall.@rule[3].dest_ip='fe80::/10'
firewall.@rule[3].dest_port='546'
firewall.@rule[3].family='ipv6'
firewall.@rule[3].target='ACCEPT'
firewall.@rule[4]=rule
firewall.@rule[4].name='Allow-MLD'
firewall.@rule[4].src='wan'
firewall.@rule[4].proto='icmp'
firewall.@rule[4].src_ip='fe80::/10'
firewall.@rule[4].icmp_type='130/0' '131/0' '132/0' '143/0'
firewall.@rule[4].family='ipv6'
firewall.@rule[4].target='ACCEPT'
firewall.@rule[5]=rule
firewall.@rule[5].name='Allow-ICMPv6-Input'
firewall.@rule[5].src='wan'
firewall.@rule[5].proto='icmp'
firewall.@rule[5].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type' 'router-solicitation' 'neighbour-solicitation' 'router-advertisement' 'neighbour-advertisement'
firewall.@rule[5].limit='1000/sec'
firewall.@rule[5].family='ipv6'
firewall.@rule[5].target='ACCEPT'
firewall.@rule[6]=rule
firewall.@rule[6].name='Allow-ICMPv6-Forward'
firewall.@rule[6].src='wan'
firewall.@rule[6].dest='*'
firewall.@rule[6].proto='icmp'
firewall.@rule[6].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type'
firewall.@rule[6].limit='1000/sec'
firewall.@rule[6].family='ipv6'
firewall.@rule[6].target='ACCEPT'
firewall.@include[0]=include
firewall.@include[0].path='/etc/firewall.user'
firewall.@rule[7]=rule
firewall.@rule[7].src='wan'
firewall.@rule[7].dest='lan'
firewall.@rule[7].proto='esp'
firewall.@rule[7].target='ACCEPT'
firewall.@rule[8]=rule
firewall.@rule[8].src='wan'
firewall.@rule[8].dest='lan'
firewall.@rule[8].dest_port='500'
firewall.@rule[8].proto='udp'
firewall.@rule[8].target='ACCEPT'
firewall.@zone[2]=zone
firewall.@zone[2].input='ACCEPT'
firewall.@zone[2].forward='ACCEPT'
firewall.@zone[2].output='ACCEPT'
firewall.@zone[2].name='vpnZone'
firewall.@zone[2].network='VPN'
firewall.@zone[2].mtu_fix='1'
firewall.@zone[2].log='1'
firewall.@zone[2].log_limit='60'
firewall.@forwarding[0]=forwarding
firewall.@forwarding[0].dest='wan'
firewall.@forwarding[0].src='lan'
firewall.@rule[9]=rule
firewall.@rule[9].enabled='1'
firewall.@rule[9].target='ACCEPT'
firewall.@rule[9].proto='tcp'
firewall.@rule[9].dest_port='80'
firewall.@rule[9].name='HTTP'
firewall.@rule[9].src='*'
firewall.@forwarding[1]=forwarding
firewall.@forwarding[1].dest='lan'
firewall.@forwarding[1].src='vpnZone'
firewall.@forwarding[2]=forwarding
firewall.@forwarding[2].dest='wan'
firewall.@forwarding[2].src='vpnZone'
firewall.@forwarding[3]=forwarding
firewall.@forwarding[3].dest='vpnZone'
firewall.@forwarding[3].src='lan'
firewall.@forwarding[4]=forwarding
firewall.@forwarding[4].dest='vpnZone'
firewall.@forwarding[4].src='wan'
firewall.@redirect[0]=redirect
firewall.@redirect[0].target='DNAT'
firewall.@redirect[0].src='vpnZone'
firewall.@redirect[0].dest='vpnZone'
firewall.@redirect[0].proto='tcp'
firewall.@redirect[0].src_dport='80'
firewall.@redirect[0].dest_port='80'
firewall.@redirect[0].name='HTTP'
root@OpenWrt:~# iptables -v -L
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
4 272 delegate_input all -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 delegate_forward all -- any any anywhere anywhere
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
3 188 delegate_output all -- any any anywhere anywhere
Chain delegate_forward (1 references)
pkts bytes target prot opt in out source destination
0 0 forwarding_rule all -- any any anywhere anywhere /* user chain for forwarding */
0 0 ACCEPT all -- any any anywhere anywhere ctstate RELATED,ESTABLISHED
0 0 zone_lan_forward all -- br-lan any anywhere anywhere
0 0 zone_wan_forward all -- wlan0 any anywhere anywhere
0 0 zone_vpnZone_forward all -- pptp-VPN any anywhere anywhere
Chain delegate_input (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- lo any anywhere anywhere
4 272 input_rule all -- any any anywhere anywhere /* user chain for input */
3 224 ACCEPT all -- any any anywhere anywhere ctstate RELATED,ESTABLISHED
0 0 syn_flood tcp -- any any anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:www /* HTTP */
0 0 zone_lan_input all -- br-lan any anywhere anywhere
1 48 zone_wan_input all -- wlan0 any anywhere anywhere
0 0 zone_vpnZone_input all -- pptp-VPN any anywhere anywhere
Chain delegate_output (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any lo anywhere anywhere
3 188 output_rule all -- any any anywhere anywhere /* user chain for output */
2 144 ACCEPT all -- any any anywhere anywhere ctstate RELATED,ESTABLISHED
0 0 zone_lan_output all -- any br-lan anywhere anywhere
1 44 zone_wan_output all -- any wlan0 anywhere anywhere
0 0 zone_vpnZone_output all -- any pptp-VPN anywhere anywhere
Chain forwarding_lan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain forwarding_rule (1 references)
pkts bytes target prot opt in out source destination
Chain forwarding_vpnZone_rule (1 references)
pkts bytes target prot opt in out source destination
Chain forwarding_wan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain input_lan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain input_rule (1 references)
pkts bytes target prot opt in out source destination
Chain input_vpnZone_rule (1 references)
pkts bytes target prot opt in out source destination
Chain input_wan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain output_lan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain output_rule (1 references)
pkts bytes target prot opt in out source destination
Chain output_vpnZone_rule (1 references)
pkts bytes target prot opt in out source destination
Chain output_wan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain reject (0 references)
pkts bytes target prot opt in out source destination
0 0 REJECT tcp -- any any anywhere anywhere reject-with tcp-reset
0 0 REJECT all -- any any anywhere anywhere reject-with icmp-port-unreachable
Chain syn_flood (1 references)
pkts bytes target prot opt in out source destination
0 0 RETURN tcp -- any any anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN limit: avg 25/sec burst 50
0 0 DROP all -- any any anywhere anywhere
Chain zone_lan_dest_ACCEPT (5 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any br-lan anywhere anywhere
Chain zone_lan_forward (1 references)
pkts bytes target prot opt in out source destination
0 0 forwarding_lan_rule all -- any any anywhere anywhere /* user chain for forwarding */
0 0 zone_wan_dest_ACCEPT all -- any any anywhere anywhere /* forwarding lan -> wan */
0 0 zone_vpnZone_dest_ACCEPT all -- any any anywhere anywhere /* forwarding lan -> vpnZone */
0 0 ACCEPT all -- any any anywhere anywhere ctstate DNAT /* Accept port forwards */
0 0 zone_lan_dest_ACCEPT all -- any any anywhere anywhere
Chain zone_lan_input (1 references)
pkts bytes target prot opt in out source destination
0 0 input_lan_rule all -- any any anywhere anywhere /* user chain for input */
0 0 ACCEPT all -- any any anywhere anywhere ctstate DNAT /* Accept port redirections */
0 0 zone_lan_src_ACCEPT all -- any any anywhere anywhere
Chain zone_lan_output (1 references)
pkts bytes target prot opt in out source destination
0 0 output_lan_rule all -- any any anywhere anywhere /* user chain for output */
0 0 zone_lan_dest_ACCEPT all -- any any anywhere anywhere
Chain zone_lan_src_ACCEPT (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- br-lan any anywhere anywhere
Chain zone_vpnZone_dest_ACCEPT (4 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any pptp-VPN anywhere anywhere
Chain zone_vpnZone_forward (1 references)
pkts bytes target prot opt in out source destination
0 0 forwarding_vpnZone_rule all -- any any anywhere anywhere /* user chain for forwarding */
0 0 zone_lan_dest_ACCEPT all -- any any anywhere anywhere /* forwarding vpnZone -> lan */
0 0 zone_wan_dest_ACCEPT all -- any any anywhere anywhere /* forwarding vpnZone -> wan */
0 0 ACCEPT all -- any any anywhere anywhere ctstate DNAT /* Accept port forwards */
0 0 zone_vpnZone_dest_ACCEPT all -- any any anywhere anywhere
Chain zone_vpnZone_input (1 references)
pkts bytes target prot opt in out source destination
0 0 input_vpnZone_rule all -- any any anywhere anywhere /* user chain for input */
0 0 ACCEPT all -- any any anywhere anywhere ctstate DNAT /* Accept port redirections */
0 0 zone_vpnZone_src_ACCEPT all -- any any anywhere anywhere
Chain zone_vpnZone_output (1 references)
pkts bytes target prot opt in out source destination
0 0 output_vpnZone_rule all -- any any anywhere anywhere /* user chain for output */
0 0 zone_vpnZone_dest_ACCEPT all -- any any anywhere anywhere
Chain zone_vpnZone_src_ACCEPT (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- pptp-VPN any anywhere anywhere
Chain zone_wan_dest_ACCEPT (4 references)
pkts bytes target prot opt in out source destination
1 44 ACCEPT all -- any wlan0 anywhere anywhere
Chain zone_wan_forward (1 references)
pkts bytes target prot opt in out source destination
0 0 forwarding_wan_rule all -- any any anywhere anywhere /* user chain for forwarding */
0 0 zone_lan_dest_ACCEPT esp -- any any anywhere anywhere /* @rule[7] */
0 0 zone_lan_dest_ACCEPT udp -- any any anywhere anywhere udp dpt:isakmp /* @rule[8] */
0 0 zone_vpnZone_dest_ACCEPT all -- any any anywhere anywhere /* forwarding wan -> vpnZone */
0 0 ACCEPT all -- any any anywhere anywhere ctstate DNAT /* Accept port forwards */
0 0 zone_wan_dest_ACCEPT all -- any any anywhere anywhere
Chain zone_wan_input (1 references)
pkts bytes target prot opt in out source destination
1 48 input_wan_rule all -- any any anywhere anywhere /* user chain for input */
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:bootpc /* Allow-DHCP-Renew */
0 0 ACCEPT icmp -- any any anywhere anywhere icmp echo-request /* Allow-Ping */
0 0 ACCEPT igmp -- any any anywhere anywhere /* Allow-IGMP */
0 0 ACCEPT all -- any any anywhere anywhere ctstate DNAT /* Accept port redirections */
1 48 zone_wan_src_ACCEPT all -- any any anywhere anywhere
Chain zone_wan_output (1 references)
pkts bytes target prot opt in out source destination
1 44 output_wan_rule all -- any any anywhere anywhere /* user chain for output */
1 44 zone_wan_dest_ACCEPT all -- any any anywhere anywhere
Chain zone_wan_src_ACCEPT (1 references)
pkts bytes target prot opt in out source destination
1 48 ACCEPT all -- wlan0 any anywhere anywhere