Well, let's consider what you already know, that data communication, that is, the exchange and transfer of information, or data, takes place in chunks and not as a continuous flow. If you do not, the article about networking could help you.

OpenWrt relies on Netfilter to handle network packets. It is far more than a simple firewall and very powerful! Usually the user space programs iptables, ip6tables, ebtables or arptables are utilized to configure the handling of network packets. Please see this scheme Netfilter Components by Jan Engelhardt about some overview over current and future netfilter components.

• iptables for the user space program iptables

• ip6tables for the user space program ip6tables

• ebtables] for the user space program ebtables

• arptables for the user space program arptables

nftables is the successor of all of the above user space programs and shall replace them one day. Today it is in Alpha-Status: nftables and http://people.netfilter.org/kaber/weblog/2008/08/20/:

• Unification of filters (socket filter, pktsched, netfilter)!
• Similar to BPF but more sophisticated
• Contains high-level objects, like dictionaries
• Hash table, trie, bitmaps, etc.
• Rule set optimizations in userspace bevor the hook is passed to kernel
• Need to retain existing netfilter bits “forever”

• http://ipset.netfilter.org/ was mainlined in Linux Kernel Version 2.6.39

ipset

To quickly obtain a current overview type: opkg list iptables-mod-*. Install the user space module, kernel modules are listed as dependencies and will be installed as well.

Since r30676 iptables-mod-conntrack and iptables-mod-nat are folded into the default package iptables to save on storage memory.

Netfilter can be included into the kernel or installed later on as module. The same is true for the optional kernel modules. The user space modules and programs can be installed later on or included in the image.

Always install iptables-mod-*, that way the corresponding kmod-ipt-* is being installed as well.

Using this wiki only, you can go to vanilla.packages and see what packages are usually contained in a vanilla image. If your have OpenWrt already running, try some opkg-magic like: opkg list-installed | grep iptables and opkg list iptables-mod* to look for modules with matches and TARGETs you may want to utilize.

For example the Target CLASSIFY, or the match length are both included in the packages: iptables-mod-ipopt and kmod-ipt-ipopt. If you want to use them, you have to install the packages first

Please have a look at this most excellent scheme: Netfilter Packet Flow by Jan Engelhardt to understand how a packet traverses netfilter.

Note: Do not make the mistake to place your LAN on the left side and the Internet on the right side in your mind. They are both on both sides! When a packet enters the Linux Kernel (= that is the ingress buffer of the NIC /WNIC) it always comes in on the left side, regardless on which interface it arrives. It traverses the network stack and then netfilter and when it leaves, it always leaves at the right side.

The green stuff is the domain of iptables and ip6tables, while the blue stuff is being handled by ebtables. The names raw, mangle, nat and filter name tables, while the names INPUT, PREROUTING, etc. name the default CHAINs. See below!

While one any packet traverses netfilter, netfilter looks for rules that match that network packet. When a rules matches a packet, that rule is being applied to that particular packet. This means the packet is being send to the TARGET specified in that rule.

As soon as, the network packet is matching a rule, this rule is being applied to it, and the packet stops traversing that table of netfilter! But there are of course a couple of exceptions to this behaviour, e.g. the TARGETs -j LOG, -j CUSTOM_CHAIN or -j MARK.

iptables, ip6tables, ebtables, arptables and ipset are pure user space command line tools. Utilize them as follows:

root@openwrt:~# iptables -A INPUT -j ACCEPT -p tcp --dport  53 #------------------- accept incoming packets on tcp port 53 (DNS)
root@openwrt:~# iptables -A FORWARD -j REJECT -p udp --dport 135:139 #------------- Block outgoing Windows Share

iptables is a user space program, that is used to set up, maintain, and inspect the tables of IP packet filter rules in the Linux kernel. Have no fear, iptables is very user friendly, well documented and easy to understand: per invocation you can set up one rule aka (chain) link, this will be checked for mistakes and if none are found, the hook will be written to RAM and is active immediately. An iptables command always commits the table the chain belongs to, a command, then the chain this hook belongs to and then the match and the TARGET. There is always exactly one TARGET, but multiple matches are possible.

Table: -t filter -t nat -t mangle -t raw

COMMAND: -A --append -D --delete -I --insert -R --replace -L --list -F --flush -Z --zero -N --new-chain -X --delete-chain -P --policy -E --rename-chain

Builtin Chains and user defined chains: INPUT OUTPUT FORWARD PREROUTING POSTROUTING user_defined_CHAIN_1

TARGET: ACCEPT DROP QUEUE RETURN BALANCE CLASSIFY CLUSTERIP CONNMARK CONNSECMARK CONNTRACK DNAT DSCP ECN IPMARK IPV4OPSSTRIP LOG MARK MASQUERADE MIRROR NETMAP NFQUEUE NOTRACK REDIRECT REJECT ROUTE SAME SECMARK SET SNAT TARPIT TCPMSS TOS TRACE TTL ULOG XOR

Dependent on the kind of TARGET you need further parameters: -j MARK --set-mark 102
-j TEE reroute a copy of a packet
-j TARPIT
-j DELUDE does TCP handshake and the closes connection

match: -i incoming interface, -o outgoing interface
-s source ip address, -d destination ip address
-p protocol, –dport destination port –sport source port
-m match: various matches are in different iptables-mod-* packages!
-m mac –mac-source xx:xx:xx:xx:xx:xx source MAC, note that MAC is layer2
-m mark –mark abc match a packet marked with abc
-m length –length :412 match all packets with a length of less then 412 Bytes
-m ttl –ttl-eq 12 -j LOG –log-prefix "IPT TTL=12 "
-m ttl –ttl-gt 12 -j LOG –log-prefix "IPT TTL>12 "
-m ttl –ttl-lt 12 -j LOG –log-prefix "IPT TTL<12 "
-m condition match a flag changeable from userspace
-m geoip match on countries

This were a very few examples only meant to give you the basic grasp of netfilter, which is a huge step! Now for a thorough documentation or for some detailed tutorials, please see the Notes.

You find some example shell scripts below:

• netfilter.iptables.example1 very simple script for setting up NAT (IPv4 only, IPv6 has no NAT)
• netfilter.iptables.example2 simple script with filters (such an implementation is usually called a firewall)
• netfilter.iptables.example3 Protocol usage with iptables

• netfilter.ip6tables.example1 Basic rules for empty ip6tables (like in firewall_v1) including tunnel support
• ip6tables.example2
• ip6tables.example3

• netfilter.ebtables.example1

• Wlan traffic seems to bypass iptables

• Project Hompage http://www.netfilter.org/
• One of the best Tutorials http://www.frozentux.net/iptables-tutorial/iptables-tutorial.html by Oskar Andreasson, incomplete, certain matches are missing
• Another Tutorial http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch14_:_Linux_Firewalls_Using_iptables
• A short HowTo-like help: http://www.akadia.com/services/pppoe_iptables.html
• German introduction: http://www.linux-community.de/Internal/Artikel/Print-Artikel/LinuxUser/2002/05/Paketfilter-Firewall