Hi,

I'm curious as to how the [icode]defconf: drop all not coming from LAN[/icode] and [icode]defconf: drop all from WAN not DSTNATed[/icode] firewall rules interact - surely the latter (which is placed as the last rule) will never be reached, as any WAN packets will have been dropped by the former? Or do the NAT rules change the source interface (which doesn't sound correct)?

Or is it expected that one will be disabled over the other? I understand the router at an intermediate level, but that specific default configuration is confusing me.

Liam

I prefer.
Drop all as a last rule and if I need port forwarding on the LAN side I make a specific rule for that.
much clearer for all.

Ah, so the one on the INPUT chain only blocks access to the router from the WAN, but not to other destinations travelling via the router. Makes sense now, thanks!

I always sort the firewall rules so that first all the forward rules appear and then all the input rules. makes things a lot clearer.
But of course while manually sorting them (moving them around using the mouse within the listed rules), you must keep the sequence within the same chain the same as it is now.