Understanding OpenWRT LuCI Firewall Routing with VPN

Question

I'm still fairly new to networking, and I'm having a little trouble grasping some concepts of the proper firewall rules I need to implement for my desired setup. I'm setting up a router with OpenWRT and OpenVPN to route incoming traffic through my VPN provider (proxy.sh). I've largely got things setup adapting from these two guides:

blog.ipredator.se/howto/openwrt/configuring-openvpn-on-openwrt.html tokyobreeze.wordpress.com/2015/01/15/install-openvpn-in-a-router-with-4mb-flash/

One thing I'm having trouble understanding is OpenWRT's LuCI firewall rules. The basic idea is all traffic coming in from the LAN port is forwarded to the VPN interface and packets are masqueraded behind the VPN interface. If the VPN disconnects, then traffic is dropped and no ip is leaked. Where these guides differ is in one, the WAN (which connects to the web) port is set to its normal settings with input rejected, and masquerading on (see below image)

While the other guide instead turns off masquerading on the WAN port, and allows input (see below image).

Both configurations work for me, (and pass all the tests on ipleak.net) but I'd like to better understand what's going on and make sure I'm secure. So can someone please explain/help me understand...

1. If and why one approach is better or more secure than the other?
2. These rules/how the packet routing actually works? I don't think I quite understand what is going on. For example, I don't understand why if masquerading is turned off on the WAN interface, input needs to be allowed on the WAN interface (I checked this config and ineed it doesn't work unless WAN input is allowed). The explanation the author gives is too brief and doesn't make sense to me. My understanding (which is probably wrong) of input not being allowed is that the interface only accepts packets returning from an outgoing request and not packets from a new connection (again new to networking here). So if a packet is sent out over the VPN interface (with WAN masquerading turned off), why is its return packet rejected by the WAN interface if WAN input is disallowed? Wouldn't it be a response just like any other?

Answer 1

To answer question 1, I don't think either setting is as secure as you ought to be. Option 1 leaves masq turned on for the WAN when it doesn't need to be. Option 2 sets up a default accept rule for the WAN when it doesn't need to be.

To answer question 2 and fill in the blanks on question 1: The input/output rule settings in OpenWRT are the default behavior for traffic. Specific rules can then be added to deviate, for example if you set the WAN to input reject (which is the default), you then need to go in and specifically allow things to happen (like masquerading to do NAT which is there by default, or an accept rule to allow incoming SSH which is not there by default and hence no SSH can come from the WAN to the router). When you turned of Masquerade and left the WAN config at reject, there was no way for anything to get in that didn't fit into an allow rule (even OpenVPN traffic). If you then went to the firewall traffic rules and specifically allowed the OpenVPN traffic through (1194 UDP by default), it would work in reject mode. This is a better choice since leaving the WAN in accept means any services on your router (like ssh or SMB) are left to fend for themselves against incoming (possibly malicious) traffic. It's best practice to deny everything and then poke just what you need through.