Index: openwrt/package/iptables/files/firewall.awk
===================================================================
--- openwrt/package/iptables/files/firewall.awk	(revision 7256)
+++ openwrt/package/iptables/files/firewall.awk	(working copy)
@@ -16,7 +16,7 @@
 ($1 == "accept") {
 	target = " -j ACCEPT"
 	for (o in _opt) {
-		print "iptables -t nat -A prerouting_wan" _opt[o] str2ipt($2) target
+		print "iptables        -A forwarding_wan" _opt[o] str2ipt($2) target
 		print "iptables        -A input_wan     " _opt[o] str2ipt($2) target
 		print ""
 	}
@@ -24,7 +24,8 @@
 
 ($1 == "drop") {
 	for (o in _opt) {
-		print "iptables -t nat -A prerouting_wan" _opt[o] str2ipt($2) " -j DROP"
+		print "iptables        -A forwarding_wan" _opt[o] str2ipt($2) " -j DROP"
+		print "iptables        -A input_wan     " _opt[o] str2ipt($2) " -j DROP"
 		print ""
 	}
 }
@@ -32,6 +33,7 @@
 ($1 == "forward") {
 	target = " -j DNAT --to " $3
 	fwopts = ""
+	fwflt = ""
 	if ($4 != "") {
 		if ((_l["proto"] == "tcp") || (_l["proto"] == "udp") || (_l["proto"] == "")) {
 			if (_l["proto"] != "") fwopts = " -p " _l["proto"]
@@ -39,10 +41,16 @@
 			target = target ":" $4
 		}
 		else fwopts = ""
+	} else {
+		if ((_l["proto"] == "tcp") || (_l["proto"] == "udp") || (_l["proto"] == "")) {
+			if (_l["proto"] != "") fwflt = " -p " _l["proto"]
+			if (_l["sport"] != "") fwflt = fwflt portstr("src", _l["sport"])
+			if (_l["dport"] != "") fwflt = fwflt portstr("dest", _l["dport"])
+		}
 	}
 	for (o in _opt) {
-		print "iptables -t nat -A prerouting_wan" _opt[o] str2ipt($2) target
-		print "iptables        -A forwarding_wan   " _opt[o] " -d " $3 fwopts " -j ACCEPT"
+		print "iptables -t nat -A prerouting_wan " _opt[o] str2ipt($2) target
+		print "iptables        -A forwarding_wan " _opt[o] fwflt " -d " $3 fwopts " -j ACCEPT"
 		print ""
 	}
 }