----config/network---
config options internal
        option forward  'lan wifi'
        option nat      'lan wifi'
----config/network---


----init.d/firewall---
        config_get NAT_IFS internal nat
        config_get FWD_IFS internal forward

:
:

        # allow
        ### Handle forward settings
        for IF in "$FWD_IFS"; do
                iptables -A FORWARD -i $IF -o $IF -j ACCEPT
                [ -z "$WAN" ] || iptables -A FORWARD -i $IF -o $WAN -j ACCEPT
        done

:
:

        iptables -t nat -A POSTROUTING -j postrouting_rule
        ### Handle NAT settings
        for I in "$NAT_IFS"; do
                config_get CURR_MASK $I netmask
                config_get CURR_IP $I ipaddr
                CURR_NET=$(/bin/ipcalc.sh $CURR_IP $CURR_MASK | grep NETWORK | c

                [ -z "$WAN" ] || iptables -t nat -A POSTROUTING --src $CURR_NET/
        done