openwrt / openwrt/firewall4

firewall4: should enforce "strong host" model

Open
#93 73 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
ucode
Stars
27
Forks
37
PR merge metrics
No merged PRs in 30d

Description

If you have a router with two wan interfaces, and one of them is the egress interface for the default route, then that traffic will pick that interface for egress and NATting for return traffic (pings, redirects to internal hosts, etc).

That is, if I have wan and wan2 and the default route is via wan, but I ping the address of wan2, then the echo replies will come back with the source of wan.

Similarly if I do port-forwarding via redirect rules on wan2, the return traffic will come back with the source address of wan.

Choosing the correct interface for routing and NATting is a firewall function.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file or test is named; start by reviewing the 73-comment discussion and the firewall4 routing and NAT handling relevant to dual-WAN traffic. Reproduce the wan/wan2 default-route and redirect cases described here, then verify that replies and return traffic use the correct interface and source address.

Written by the indexing model from the issue text.

Assessment

Domain
networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.