Firewall Rules and Guest Network

[mmtj]

@guinhas

So firewall zones consist of interfaces/networks themselves, but in the lan zone the only interface is lan, so it doesn’t really matter if forward is accept or reject because there’s only one network/interface in the lan zone. The only zone with 2 interfaces is wan, it consists of wan and wan6. The bridge you’re talking about is in the lan interface, not the lan zone, right?

I got few things mixed up, so disregard that advice.
You got it right - even though with single interface ACCEPT/REJECT shouldn’t make a difference, there is no reason to set ACCEPT there.

@guinhas

As to the Guest Network part, I’m sorry I didn’t explain myself better, but I didn’t change anything in the Firewall section of Luci, that’s why I was asking about this. If you enable Guest Network in Foris and then go to Luci → Firewall → Traffic Rules and hit Save & Apply without changing anything, Guest Network gets disabled in Foris, even though everything keeps working as usual.

Thanks for clarification, I was able to reproduce it exactly as you described it.

There is indeed “bug” in handling guest network rules, that is also quite good example of Foris and LuCi coexistence.

This situation is caused by different treatment of firewall rules from both admin interfaces.

Foris use option enabled to detect if settings is applied.
LuCi on the other hand use option enabled only as confirmation that this particular config section is disabled (option disabled 0), while mere existence of section is considered as enabled.

Thus when you do “Save & Apply” in LuCi, it delete option enabled in all relevant config sections and Foris then don’t consider guest network as active. Even though it actually is active.

I’m not sure what is the best solution here. In my opinion, using option enabled in all cases is simpler to work with, but apparently LuCi developers thinks otherwise.