/etc/config/firewall
config policy lan
	option nat      wan
	option allow    wan

config accept ssh
	option proto tcp
	option dport 22
	option module state
	option state new

config accept icmp
	option proto icmp

config forward webserver
	option target           192.168.1.10
	option proto            tcp
	option dports           80,443

/etc/init.d/firewall

#!/bin/sh /etc/rc.common
# Copyright (C) 2006 OpenWrt.org

## Please make changes in /etc/firewall.user
START=45

get_variables() {
	config_get proto "$1" proto
	config_get dport "$1" dport
	config_get dports "$1" dports
	[ -n "$dports" ] && dports=`echo $dports | sed 's/-/:/'`
	[ -n "$dports" ] && dports="-m multiport --dports $dports"
	config_get sport "$1" sport
	config_get sports "$1" sports
	[ -n "$sports" ] && sports=`echo $sports | sed 's/-/:/'`
	[ -n "$sports" -a -z "$dports" ] && sports="-m multiport --sports $sports"
	[ -n "$sports" -a -n "$dports" ] && sports="--sports $sports"
	config_get dest "$1" dest
	config_get source "$1" source
	config_get target "$1" target
}

config_cb() {
	local cfg_type="$1" #TYPE
	export cfg_name_firewall="$2"
	case "$cfg_type" in
		policy)
			option_cb() {
				case "$1" in
					allow)
						(include /lib/network
						scan_interfaces
						# Allow connections between networks
						config_get iface1 "$cfg_name_firewall" ifname
						config_get iface2 $2 ifname
						echo "iptables -A FORWARD -i $iface1 -o $iface2 -j ACCEPT">>/tmp/firewall)
					;;
					nat)
						(include /lib/network
						scan_interfaces
						config_get LAN_MASK "$cfg_name_firewall" netmask
						config_get LAN_IP "$cfg_name_firewall" ipaddr
						LAN_NET=$(/bin/ipcalc.sh $LAN_IP $LAN_MASK | grep NETWORK | cut -d= -f2)
						echo "iptables -t nat -A POSTROUTING --src $LAN_NET/$LAN_MASK -o $2 -j MASQUERADE">>/tmp/firewall)
					;;
				esac
			}
		;;
		forward)
			append forward "$cfg_name_firewall" "$N"
		;;
		accept)
			append accept "$cfg_name_firewall" "$N"
		;;	
	esac
}

clear_variables() {
	proto=
	dport=
	dports=
	sport=
	sports=
	dest=
	source=
	target=
}

start() {
	#
	# delete all existing rules.
	#
	echo "iptables -F
	iptables -t nat -F
	iptables -t mangle -F
	iptables -X
	
	# base case
	iptables -P INPUT DROP
	iptables -A INPUT -m state --state INVALID -j DROP
	iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
	iptables -A INPUT -p tcp --tcp-flags SYN SYN --tcp-option \! 2 -j  DROP

	iptables -P OUTPUT DROP
	iptables -A OUTPUT -m state --state INVALID -j DROP
	iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

	iptables -P FORWARD DROP 
	iptables -A FORWARD -m state --state INVALID -j DROP
	iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
	iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT">/tmp/firewall

	uci_load firewall
	for section in $forward; do
		clear_options
		get_info "$section"
		echo "iptables -A PREROUTING -t nat -p $proto ${source:+ --source $source} ${dest:+ -d $dest} ${dport:+ --dport $dport} ${dports:+ $dports} ${sports:+ $sports} -j DNAT --to $target">>/tmp/firewall
		echo "iptables -A FORWARD -p $proto -m state --state NEW ${source:+ --source $source} ${dest:+ -d $dest} ${dport:+ --dport $dport} ${dports:+ $dports} ${sports:+ $sports} -j ACCEPT">>/tmp/firewall 
	done
	for section in $accept; do
		clear_options
		get_variables "$section"
		echo "iptables -A INPUT -p $proto -m state --state NEW ${source:+ --source $source} ${dest:+ -d $dest} ${dport:+ --dport $dport} ${dports:+ $dports} ${sports:+ $sports} -j ACCEPT">>/tmp/firewall
	done
	#[ -f /etc/firewall.user ] && . /etc/firewall.user

}

stop() {
	iptables -P INPUT ACCEPT
	iptables -P OUTPUT ACCEPT
	iptables -P FORWARD ACCEPT
	iptables -F
	iptables -X
	iptables -t nat -P PREROUTING ACCEPT
	iptables -t nat -P POSTROUTING ACCEPT
	iptables -t nat -P OUTPUT ACCEPT
	iptables -t nat -F
	iptables -t nat -X
}

firewall.spec

policy[] {
	default: enum,deny,allow required;
}
forward[] {
	target: ip, required;
	proto: string;
	dports: ports;
	sports: ports;
	dport: port;
	sport: port;
	dest: ip;		# for routers with more than one "outside" ip
	src: ip;		# restrict connections to a source host
}
allow[] {
	proto: string;
	dports: ports;
	sports: ports;
	dport: port;
	sport: port;
	dest: ip;		# for routers with more than one "outside" ip
	src: ip;		# restrict connections to a source host
}
drop[] {
	proto: string;
	dports: ports;
	sports: ports;
	dport: port;
	sport: port;
	dest: ip;		# for routers with more than one "outside" ip
	src: ip;		# restrict connections to a source host
}