Correct steps to change firewall on openwrt

[muink]

if i use einat on openwrt (192.168.1.1/24)

1. Turn off masquerade on the wan interface
2. Allow ports 20000-29999 of 192.168.1.1 on input_wan
3. Allow ports 20000-29999 forwarded to 192.168.1.0/24 on forward_wan

Are these steps correct? Are there any omissions?

[EHfive]

I guess you have figured it out by yourself.

I think what you have described is correct and enough(edit: mostly correct) for einat to work on OpenWrt in addition to its default firewall rules, especially allowing Endpoint-Independent Filtering behavior.

2. Allow ports 20000-29999 of 192.168.1.1 on input_wan

I assume you mean "Allow ports 20000-29999 of external IP on input_wan" here.

3. Allow ports 20000-29999 forwarded to 192.168.1.0/24 on forward_wan

edit: It should be allow all traffic forwarding from WAN to LAN, as internal traffic behind einat does not sees external ports(i.e. the default 20000-29999).

[EHfive]

Just to clarify, einat does not rely on any firewall(nftables/iptables) to work, the extra firewall rules mentioned here is just to relax default stricter firewall behavior so the EIM + EIF behavior expected by user of einat is still guaranteed.

[muink]

Thanks, I think I understand this part. and added this part of the rules and it works fine.
https://github.com/muink/openwrt-einat-ebpf/blob/f30d46b62ca5cd2c7ac79e1f28e3d6d8b4b902a8/files/einat.init#L72-L105

[EHfive]

Thanks, I think I understand this part. and added this part of the rules and it works fine. https://github.com/muink/openwrt-einat-ebpf/blob/f30d46b62ca5cd2c7ac79e1f28e3d6d8b4b902a8/files/einat.init#L72-L105

Great job. I have mentioned your OpenWrt packages in README and OpenWrt guide.