Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to find the best (most secure) configuration for the firewall in OpenWRT.

I'm using LuCi to configure all the stuff. I have successfully created a VPN (OpenVPN). It is supposed the best way is create 3 zones (wan, lan and vpn) in the firewall and then configure it.

My problem is if I create 3 zones, I cannot establish a tunnel in OpenVPN from internet to my router running OpenWRT. Only works when I set 1 zone including the 3: wan, lan and vpn (see attached image).

Are you using a OpenVPN? how are you configuring the firewall for the VPN?

enter image description here

share|improve this question

Check out these two guides for more info:

The basic idea is to create 3 separate zones, use zone forwarding from LAN to VPN, and turn on Masquerading and MSS clamping on the VPN zone. Be sure to leave Forward on "Reject" for all zones, Output "Accept" on all zones. Accept input on LAN but not VPN. For the WAN zone there are two possibilities (I'm not sure which is "correct" but both work for me and allow me to pass all tests on

  1. Input=Reject, Output=Accept, Forward=Reject. Turn on Masquerading and MSS clamping enter image description here
  2. Input=Accept, Output=Accept, Forward=Reject. Turn off Masquerading and MSS clamping enter image description here

Lastly, if you're not already aware, make sure prevent DNS, ipv6, etc. leaks as described in the above guides. I've found to be a good place to test my setup each time.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.