0

I have some internal mesh wifi devices that take internet from a router and share them around the house. The devices are not the best engineered - from a software perspective - so I am taking it on myself to try to improve their behavior. I am only doing this because I have root access to them, and they're kind of fun to play with. I have experimented and noticed much faster performance if I delete all of the iptables rules, but I can't quite figure out if they're needed (no firewall required as they're behind a firewalled router). There are no guest wifi networks. Some of the rules seem important, but I can't be sure that I'm not deleting something that I should keep. I'm thinking that the mssfix might be necessary. Here's the list of rules:

#AP/system/shell>iptables -vL -t filter
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 554K   46M delegate_input  all  --  any    any     anywhere             anywhere            

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 delegate_forward  all  --  any    any     anywhere             anywhere            

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 548K   44M delegate_output  all  --  any    any     anywhere             anywhere            

Chain delegate_forward (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 forwarding_rule  all  --  any    any     anywhere             anywhere             /* user chain for forwarding */
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED
    0     0 zone_lan_forward  all  --  br-lan any     anywhere             anywhere            
    0     0 zone_wan_forward  all  --  eth1   any     anywhere             anywhere            
    0     0 reject     all  --  any    any     anywhere             anywhere            

Chain delegate_input (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 479K   38M ACCEPT     all  --  lo     any     anywhere             anywhere            
74198 8156K input_rule  all  --  any    any     anywhere             anywhere             /* user chain for input */
68338 5864K ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED
    1    64 syn_flood  tcp  --  any    any     anywhere             anywhere             tcp flags:FIN,SYN,RST,ACK/SYN
 5860 2292K zone_lan_input  all  --  br-lan any     anywhere             anywhere            
    0     0 zone_wan_input  all  --  eth1   any     anywhere             anywhere            

Chain delegate_output (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 479K   38M ACCEPT     all  --  any    lo      anywhere             anywhere            
68327 5734K output_rule  all  --  any    any     anywhere             anywhere             /* user chain for output */
  365 34067 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED
67962 5700K zone_lan_output  all  --  any    br-lan  anywhere             anywhere            
    0     0 zone_wan_output  all  --  any    eth1    anywhere             anywhere            

Chain forwarding_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain forwarding_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain forwarding_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain input_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain input_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain input_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain output_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain output_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain output_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain reject (3 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     tcp  --  any    any     anywhere             anywhere             reject-with tcp-reset
    0     0 REJECT     all  --  any    any     anywhere             anywhere             reject-with icmp-port-unreachable

Chain syn_flood (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    1    64 RETURN     tcp  --  any    any     anywhere             anywhere             tcp flags:FIN,SYN,RST,ACK/SYN limit: avg 25/sec burst 50
    0     0 DROP       all  --  any    any     anywhere             anywhere            

Chain zone_lan_dest_ACCEPT (4 references)
 pkts bytes target     prot opt in     out     source               destination         
67962 5700K ACCEPT     all  --  any    br-lan  anywhere             anywhere            

Chain zone_lan_forward (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 forwarding_lan_rule  all  --  any    any     anywhere             anywhere             /* user chain for forwarding */
    0     0 zone_wan_dest_ACCEPT  all  --  any    any     anywhere             anywhere             /* forwarding lan -> wan */
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT /* Accept port forwards */
    0     0 zone_lan_dest_ACCEPT  all  --  any    any     anywhere             anywhere            

Chain zone_lan_input (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 5860 2292K input_lan_rule  all  --  any    any     anywhere             anywhere             /* user chain for input */
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT /* Accept port redirections */
 5860 2292K zone_lan_src_ACCEPT  all  --  any    any     anywhere             anywhere            

Chain zone_lan_output (1 references)
 pkts bytes target     prot opt in     out     source               destination         
67962 5700K output_lan_rule  all  --  any    any     anywhere             anywhere             /* user chain for output */
67962 5700K zone_lan_dest_ACCEPT  all  --  any    any     anywhere             anywhere            

Chain zone_lan_src_ACCEPT (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 5860 2292K ACCEPT     all  --  br-lan any     anywhere             anywhere            

Chain zone_wan_dest_ACCEPT (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  any    eth1    anywhere             anywhere            

Chain zone_wan_dest_REJECT (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 reject     all  --  any    eth1    anywhere             anywhere            

Chain zone_wan_forward (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 forwarding_wan_rule  all  --  any    any     anywhere             anywhere             /* user chain for forwarding */
    0     0 zone_lan_dest_ACCEPT  esp  --  any    any     anywhere             anywhere             /* @rule[7] */
    0     0 zone_lan_dest_ACCEPT  udp  --  any    any     anywhere             anywhere             udp dpt:isakmp /* @rule[8] */
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT /* Accept port forwards */
    0     0 zone_wan_dest_REJECT  all  --  any    any     anywhere             anywhere            

Chain zone_wan_input (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 input_wan_rule  all  --  any    any     anywhere             anywhere             /* user chain for input */
    0     0 ACCEPT     udp  --  any    any     anywhere             anywhere             udp dpt:bootpc /* Allow-DHCP-Renew */
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp echo-request /* Allow-Ping */
    0     0 ACCEPT     igmp --  any    any     anywhere             anywhere             /* Allow-IGMP */
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT /* Accept port redirections */
    0     0 zone_wan_src_REJECT  all  --  any    any     anywhere             anywhere            

Chain zone_wan_output (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 output_wan_rule  all  --  any    any     anywhere             anywhere             /* user chain for output */
    0     0 zone_wan_dest_ACCEPT  all  --  any    any     anywhere             anywhere            

Chain zone_wan_src_REJECT (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 reject     all  --  eth1   any     anywhere             anywhere            

#AP/system/shell>iptables -vL -t nat
Chain PREROUTING (policy ACCEPT 34316 packets, 8312K bytes)
 pkts bytes target     prot opt in     out     source               destination         
34316 8312K delegate_prerouting  all  --  any    any     anywhere             anywhere            

Chain INPUT (policy ACCEPT 77 packets, 22741 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 71267 packets, 5898K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 71267 packets, 5898K bytes)
 pkts bytes target     prot opt in     out     source               destination         
71267 5898K delegate_postrouting  all  --  any    any     anywhere             anywhere            

Chain delegate_postrouting (1 references)
 pkts bytes target     prot opt in     out     source               destination         
71267 5898K postrouting_rule  all  --  any    any     anywhere             anywhere             /* user chain for postrouting */
67949 5699K zone_lan_postrouting  all  --  any    br-lan  anywhere             anywhere            
    0     0 zone_wan_postrouting  all  --  any    eth1    anywhere             anywhere            

Chain delegate_prerouting (1 references)
 pkts bytes target     prot opt in     out     source               destination         
34316 8312K prerouting_rule  all  --  any    any     anywhere             anywhere             /* user chain for prerouting */
34316 8312K zone_lan_prerouting  all  --  br-lan any     anywhere             anywhere            
    0     0 zone_wan_prerouting  all  --  eth1   any     anywhere             anywhere            

Chain postrouting_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain postrouting_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain postrouting_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain prerouting_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain prerouting_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain prerouting_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain zone_lan_postrouting (1 references)
 pkts bytes target     prot opt in     out     source               destination         
67949 5699K postrouting_lan_rule  all  --  any    any     anywhere             anywhere             /* user chain for postrouting */

Chain zone_lan_prerouting (1 references)
 pkts bytes target     prot opt in     out     source               destination         
34316 8312K prerouting_lan_rule  all  --  any    any     anywhere             anywhere             /* user chain for prerouting */

Chain zone_wan_postrouting (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 postrouting_wan_rule  all  --  any    any     anywhere             anywhere             /* user chain for postrouting */
    0     0 MASQUERADE  all  --  any    any     anywhere             anywhere            

Chain zone_wan_prerouting (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 prerouting_wan_rule  all  --  any    any     anywhere             anywhere             /* user chain for prerouting */

#AP/system/shell>iptables -vL -t mangle
Chain PREROUTING (policy ACCEPT 588K packets, 54M bytes)
 pkts bytes target     prot opt in     out     source               destination         
 588K   54M fwmark     all  --  any    any     anywhere             anywhere            

Chain INPUT (policy ACCEPT 554K packets, 46M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 mssfix     all  --  any    any     anywhere             anywhere            

Chain OUTPUT (policy ACCEPT 548K packets, 44M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 548K packets, 44M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain fwmark (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain mssfix (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 TCPMSS     tcp  --  any    eth1    anywhere             anywhere             tcp flags:SYN,RST/SYN /* wan (mtu_fix) */ TCPMSS clamp to PMTU

#AP/system/shell>iptables -vL -t raw
Chain PREROUTING (policy ACCEPT 588K packets, 54M bytes)
 pkts bytes target     prot opt in     out     source               destination         
 588K   54M delegate_notrack  all  --  any    any     anywhere             anywhere            

Chain OUTPUT (policy ACCEPT 548K packets, 44M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain delegate_notrack (1 references)
 pkts bytes target     prot opt in     out     source               destination         

#AP/system/shell>iptables -vL -t security
iptables v1.4.21: can't initialize iptables table `security': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.

and using iptables-save:

#AP/system/shell>iptables-save
# Generated by iptables-save v1.4.21 on Mon Aug 12 21:38:07 2019
*nat
:PREROUTING ACCEPT [34328:8315040]
:INPUT ACCEPT [77:22741]
:OUTPUT ACCEPT [71298:5900736]
:POSTROUTING ACCEPT [71298:5900736]
:delegate_postrouting - [0:0]
:delegate_prerouting - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -j delegate_prerouting
-A POSTROUTING -j delegate_postrouting
-A delegate_postrouting -m comment --comment "user chain for postrouting" -j postrouting_rule
-A delegate_postrouting -o br-lan -j zone_lan_postrouting
-A delegate_postrouting -o eth1 -j zone_wan_postrouting
-A delegate_prerouting -m comment --comment "user chain for prerouting" -j prerouting_rule
-A delegate_prerouting -i br-lan -j zone_lan_prerouting
-A delegate_prerouting -i eth1 -j zone_wan_prerouting
-A zone_lan_postrouting -m comment --comment "user chain for postrouting" -j postrouting_lan_rule
-A zone_lan_prerouting -m comment --comment "user chain for prerouting" -j prerouting_lan_rule
-A zone_wan_postrouting -m comment --comment "user chain for postrouting" -j postrouting_wan_rule
-A zone_wan_postrouting -j MASQUERADE
-A zone_wan_prerouting -m comment --comment "user chain for prerouting" -j prerouting_wan_rule
COMMIT
# Completed on Mon Aug 12 21:38:07 2019
# Generated by iptables-save v1.4.21 on Mon Aug 12 21:38:07 2019
*raw
:PREROUTING ACCEPT [588017:54321919]
:OUTPUT ACCEPT [547887:43622763]
:delegate_notrack - [0:0]
-A PREROUTING -j delegate_notrack
COMMIT
# Completed on Mon Aug 12 21:38:07 2019
# Generated by iptables-save v1.4.21 on Mon Aug 12 21:38:07 2019
*mangle
:PREROUTING ACCEPT [588017:54321919]
:INPUT ACCEPT [553766:46029620]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [547887:43622763]
:POSTROUTING ACCEPT [547887:43622763]
:fwmark - [0:0]
:mssfix - [0:0]
-A PREROUTING -j fwmark
-A FORWARD -j mssfix
-A mssfix -o eth1 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "wan (mtu_fix)" -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Mon Aug 12 21:38:07 2019
# Generated by iptables-save v1.4.21 on Mon Aug 12 21:38:07 2019
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:delegate_forward - [0:0]
:delegate_input - [0:0]
:delegate_output - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -j delegate_input
-A FORWARD -j delegate_forward
-A OUTPUT -j delegate_output
-A delegate_forward -m comment --comment "user chain for forwarding" -j forwarding_rule
-A delegate_forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A delegate_forward -i br-lan -j zone_lan_forward
-A delegate_forward -i eth1 -j zone_wan_forward
-A delegate_forward -j reject
-A delegate_input -i lo -j ACCEPT
-A delegate_input -m comment --comment "user chain for input" -j input_rule
-A delegate_input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A delegate_input -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j syn_flood
-A delegate_input -i br-lan -j zone_lan_input
-A delegate_input -i eth1 -j zone_wan_input
-A delegate_output -o lo -j ACCEPT
-A delegate_output -m comment --comment "user chain for output" -j output_rule
-A delegate_output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A delegate_output -o br-lan -j zone_lan_output
-A delegate_output -o eth1 -j zone_wan_output
-A reject -p tcp -j REJECT --reject-with tcp-reset
-A reject -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -j RETURN
-A syn_flood -j DROP
-A zone_lan_dest_ACCEPT -o br-lan -j ACCEPT
-A zone_lan_forward -m comment --comment "user chain for forwarding" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "forwarding lan -> wan" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "Accept port forwards" -j ACCEPT
-A zone_lan_forward -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "user chain for input" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "Accept port redirections" -j ACCEPT
-A zone_lan_input -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "user chain for output" -j output_lan_rule
-A zone_lan_output -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth1 -j ACCEPT
-A zone_wan_dest_REJECT -o eth1 -j reject
-A zone_wan_forward -m comment --comment "user chain for forwarding" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "@rule[7]" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "@rule[8]" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "Accept port forwards" -j ACCEPT
-A zone_wan_forward -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "user chain for input" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment Allow-DHCP-Renew -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment Allow-Ping -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment Allow-IGMP -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "Accept port redirections" -j ACCEPT
-A zone_wan_input -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "user chain for output" -j output_wan_rule
-A zone_wan_output -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i eth1 -j reject
COMMIT
# Completed on Mon Aug 12 21:38:07 2019

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.