Digi TransPort LR54 - System Chains; Migration of Rules from Older Firmware; Future Releases

Advanced topics Understanding system firewall rules
Digi TransPort WR Routers User Guide
512
digi.router> show firewall
Filter Table
------------
Chain INPUT (policy DROP 8 packets, 2523 bytes)
num pkts bytes target prot opt in out source destination
...
4 798 92581 tlr_wan_input all -- any any anywhere anywhere /* (autogenerated) wan */
...
12 0 0 DROP tcp -- eth+ any anywhere anywhere tcp dpt:443 /* BLOCK-HTTPS-EXAMPLE */
...
Chain tlr_wan_input (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT tcp -- eth1 any anywhere anywhere tcp dpt:443 /* (autogenerated) wan 1 */
...
System chains
The system creates iptables chains named with the prefix tlr_.
n Do not modify rules in tlr chains using the firewall or firewall6 commands. Changes will be
discarded.
n Do not modify rules jumping to or from tlr chains. Changes will be discarded or negatively
affect the system configuration.
Migration of rules from older firmware
Prior to TransPort 1.4.0.0 firmware, all firewall rules (both user and system) were saved in the
FIREWALL section of the configuration file config.da0. The rules were restored as one unit during
startup as part of system initialization.
With TransPort firmware 1.4.0.0 and later, any firewall rules recognized as system firewall rules are
migrated out of the configuration file and are now managed by the system. The system firewall rules
run each time the device is started or when configuration changes result in new or modified system
firewall rules.
Future releases
System firewall rules will continue to change and be restructured as subsequent versions of the
TransPort firmware are released. If you create or modify firewall rules using the firewall command, be
aware of the relationship between system-managed rules and the rules you create.