I'm trying to make it so that traffic from my HE ipv6 tunnel won't be routed onto my internal network. As far as I can tell, its firewall zone is not allowed to forward to my lan zone, and I even created a rule for all traffic from he:0.0.0.0/0 to lan:0.0.0.0/0:* to DROP the traffic. Yet I can still ping and connect to LAN systems from an external server. Here's my rules:

Pastebin of /etc/config/firewall here

Only custom rule is one to allow the tunnel itself to be connected (iptables -A INPUT -p 41 -i eth0 -j ACCEPT). It's running a somewhat outdated version of OpenWRT (10.03.1-RC6) but I wouldn't think that would prevent the firewall from blocking properly.

Ugh, changing it to reject forwarding on HE worked, even though it clearly says that the blanket forwarding rule is for different networks within that zone.

Yeah but you explicitly overrode the default rule with an ACCEPT for the same thing.

config 'zone'
        option 'name' 'he'
        option 'output' 'ACCEPT'
        option 'forward' 'ACCEPT'
        option 'network' 'he'
        option 'input' 'REJECT'
        option 'conntrack' '1'

Which is going to take precedence over the default rule...

(Last edited by qasdfdsaq on 7 Jul 2014, 18:38)

But isn't that linked to the Input/Output/Forward controls on luci? I'm talking about the ones in the row for that zone/on the zone page. Seems like a misleading tooltip if so.