# firewall script
mkdir -p $FIRE_PATH
echo '#!/bin/sh
ps | grep pppd | grep ppp'$UNIT' > /tmp/pppd_ppp'$UNIT'.run
if [ -s /tmp/pppd_ppp'$UNIT'.run ]; then
iptables -t nat -A PREROUTING -d '$IPLOCAL' -j WANPREROUTING
iptables -t nat -A PREROUTING -i '$IFNAME' -d '$(nvram get lan_ipaddr)'/'$(nvram get lan_netmask)' -j DROP
iptables -t nat -A POSTROUTING -o '$IFNAME' -j MASQUERADE
iptables -t nat -I PREROUTING -i '$IFNAME' -s
192.168.0.0/24 -d
192.168.0.0/16 -j ACCEPT
iptables -t nat -I POSTROUTING -o '$IFNAME' -s
192.168.0.0/16 -d
192.168.0.0/24 -j MASQUERADE
iptables -I INPUT -i br0 -d '$IPLOCAL' -j DROP
iptables -I INPUT -i '$IFNAME' -s
192.168.0.0/24 -j ACCEPT
iptables -I FORWARD -i '$IFNAME' -s
192.168.0.0/24 -j ACCEPT
iptables -I FORWARD -o '$IFNAME' -d
192.168.0.0/24 -j ACCEPT
iptables -A FORWARD -i '$IFNAME' -j wanin
iptables -A FORWARD -o '$IFNAME' -j wanout
iptables -A FORWARD -i '$IFNAME' -j upnp
# QoS rules (not needed)
# iptables -t mangle -A FORWARD -o '$IFNAME' -j QOSO
# iptables -t mangle -A OUTPUT -o '$IFNAME' -j QOSO
# iptables -t mangle -A PREROUTING -i '$IFNAME' -j CONNMARK --restore-mark --mask 0xff
fi
' > "$FIRE_PATH/ppp$
UNIT.fire"
chmod +x "$FIRE_PATH/ppp$
UNIT.fire"
mv -f $TMPF $DNSMASQ_CUSTOM
service routing restart
service dnsmasq restart
service firewall restart