firewall4: OpenWrt’s nftables firewall and its zones

Default since 22.03. Same zones, same UCI syntax.

In one sentence

Since 22.03, OpenWrt’s default firewall is firewall4 (fw4). It generates nftables rules instead of iptables, and keeps the UCI syntax of the older fw3 in /etc/config/firewall.

Zones, not rule lists

Interfaces are grouped into zones, usually lan and wan. Policies and forwardings are set between zones.
In the default setup, LAN and WAN are separate zones and LAN traffic is forwarded to WAN. Connections from WAN into your network are not forwarded unless you add a rule.
New interfaces, such as a guest network or a WireGuard tunnel, normally need a zone of their own or need to join an existing one.

See it on your router

uci show firewall | grep '=zone'
fw4 print

fw4 print prints the table, chain and rule structure fw4 would load, without applying anything. After you edit the config, fw4 reload applies it.

Watch out

Guides built on iptables -A … commands do not apply to fw4. Express the rule in UCI instead.
A wrong zone on a new interface is a common reason a tunnel or a guest network “connects but has no internet”.

Sources

Router.Homes

Independent OpenWrt notes. Every page states the firmware, device, package manager and way back.

Icons: Solar by 480 Design, CC BY 4.0