← eero conceptConcept console — static snapshot of a real build, re-skinned. Controls are not live.

Skip to navigation Skip to content

No password set!

Set a root password before connecting this device to any untrusted network.

IPv4/IPv6 traffic table "fw4"

Traffic filter chain "input"

  • Hook: input (Capture incoming packets routed to the local system), Priority: 0
  • Policy: drop (Drop unmatched packets)
Rule matchesRule actions
#
Rule comment: Accept traffic from loopback
Ingress device id is lo		Accept packet
#
Rule comment: Handle inbound flows
Verdict map: Conntrack state is established or related
established: Accept packet
related: Accept packet
#
Rule comment: Rate limit TCP syn packets
TCP flags & fin | syn is syn		Continue in syn_flood
#
Rule comment: Handle lan IPv4/IPv6 input traffic
Ingress device name is br-lan		Continue in input_lan
#
Rule comment: Handle cognitum_tailnet IPv4/IPv6 input traffic
Ingress device name is tailscale0		Continue in input_cognitum_tailnet
Any packetContinue in handle_reject

Traffic filter chain "forward"

  • Hook: forward (Capture incoming packets addressed to other hosts), Priority: 0
  • Policy: drop (Drop unmatched packets)
Rule matchesRule actions
#
Rule comment: Handle forwarded flows
Verdict map: Conntrack state is established or related
established: Accept packet
related: Accept packet
#
Rule comment: Handle lan IPv4/IPv6 forward traffic
Ingress device name is br-lan		Continue in forward_lan
#
Rule comment: Handle cognitum_tailnet IPv4/IPv6 forward traffic
Ingress device name is tailscale0		Continue in forward_cognitum_tailnet
Any packetContinue in handle_reject

Traffic filter chain "output"

  • Hook: output (Capture outgoing packets originating from the local system), Priority: 0
  • Policy: accept (Continue processing unmatched packets)
Rule matchesRule actions
#
Rule comment: Accept traffic towards loopback
Egress device id is lo		Accept packet
#
Rule comment: Handle outbound flows
Verdict map: Conntrack state is established or related
established: Accept packet
related: Accept packet
#
Rule comment: Handle lan IPv4/IPv6 output traffic
Egress device name is br-lan		Continue in output_lan
#
Rule comment: Handle cognitum_tailnet IPv4/IPv6 output traffic
Egress device name is tailscale0		Continue in output_cognitum_tailnet

Traffic filter chain "prerouting"

  • Hook: prerouting (Capture incoming packets before any routing decision), Priority: 0
  • Policy: accept (Continue processing unmatched packets)
Rule matchesRule actions
#
Rule comment: Handle lan IPv4/IPv6 helper assignment
Ingress device name is br-lan		Continue in helper_lan

Rule container chain "handle_reject"

Rule matchesRule actions
#
Rule comment: Reject TCP traffic
IP protocol is TCP		Reject packet with TCP reset
#
Rule comment: Reject any other traffic
Any packet		Reject packet with ICMP type port-unreachable

Rule container chain "syn_flood"

Rule matchesRule actions
#
Rule comment: Accept SYN packets below rate-limit
At most 25 packets per second, burst of 50 packets		Continue in calling chain
#
Rule comment: Drop excess packets
Any packet		Drop packet

Rule container chain "input_lan"

Rule matchesRule actions
Any packetContinue in accept_from_lan

Rule container chain "output_lan"

Rule matchesRule actions
Any packetContinue in accept_to_lan

Rule container chain "forward_lan"

Rule matchesRule actions
#
Rule comment: Accept lan to wan forwarding
Any packet		Continue in accept_to_wan
Any packetContinue in accept_to_lan

Rule container chain "helper_lan"

Rule matchesRule actions
No rules in this chain

Rule container chain "accept_from_lan"

Rule matchesRule actions
#
Rule comment: accept lan IPv4/IPv6 traffic
18.7 KB
Traffic matched by rule: 300 Packets, 18.7 KBytes
Ingress device name is br-lan		Accept packet

Rule container chain "accept_to_lan"

Rule matchesRule actions
#
Rule comment: accept lan IPv4/IPv6 traffic
15.6 KB
Traffic matched by rule: 100 Packets, 15.6 KBytes
Egress device name is br-lan		Accept packet

Rule container chain "input_wan"

Rule matchesRule actions
#
Rule comment: Allow-DHCP-Renew
0 B
Traffic matched by rule: 0 Packets, 0 Bytes
Address family is IPv4UDP destination port is 68		Accept packet
#
Rule comment: Allow-Ping
0 B
Traffic matched by rule: 0 Packets, 0 Bytes
ICMP type is echo-request		Accept packet
#
Rule comment: Allow-IGMP
0 B
Traffic matched by rule: 0 Packets, 0 Bytes
Address family is IPv4IP protocol is igmp		Accept packet
#
Rule comment: Allow-DHCPv6
0 B
Traffic matched by rule: 0 Packets, 0 Bytes
Address family is IPv6UDP destination port is 546		Accept packet
#
Rule comment: Allow-MLD
0 B
Traffic matched by rule: 0 Packets, 0 Bytes
Source IPv6 is fe80::/10ICMPv6 type+ICMPv6 code in set
{ mld-listener-query+0, mld-listener-report+0, mld-listener-done+0, mld2-listener-report+0 }
mld-listener-query+0
mld-listener-report+0
mld-listener-done+0
mld2-listener-report+0
Accept packet
#
Rule comment: Allow-ICMPv6-Input
0 B
Traffic matched by rule: 0 Packets, 0 Bytes
ICMPv6 type in set
{ destination-unreachable, time-exceeded, echo-request, echo-reply, nd-router-solicit, nd-router-advert }
destination-unreachable
time-exceeded
echo-request
echo-reply
nd-router-solicit
nd-router-advert
At most 1000 packets per second, burst of 5 packets		Accept packet
#
Rule comment: Allow-ICMPv6-Input
0 B
Traffic matched by rule: 0 Packets, 0 Bytes
ICMPv6 type+ICMPv6 code in set
{ packet-too-big+0, parameter-problem+0, nd-neighbor-solicit+0, nd-neighbor-advert+0, parameter-problem+1 }
packet-too-big+0
parameter-problem+0
nd-neighbor-solicit+0
nd-neighbor-advert+0
parameter-problem+1
At most 1000 packets per second, burst of 5 packets		Accept packet
Any packetContinue in reject_from_wan

Rule container chain "output_wan"

Rule matchesRule actions
Any packetContinue in accept_to_wan

Rule container chain "forward_wan"

Rule matchesRule actions
#
Rule comment: Allow-ICMPv6-Forward
0 B
Traffic matched by rule: 0 Packets, 0 Bytes
ICMPv6 type in set
{ destination-unreachable, time-exceeded, echo-request, echo-reply }
destination-unreachable
time-exceeded
echo-request
echo-reply
At most 1000 packets per second, burst of 5 packets		Accept packet
#
Rule comment: Allow-ICMPv6-Forward
0 B
Traffic matched by rule: 0 Packets, 0 Bytes
ICMPv6 type+ICMPv6 code in set
{ packet-too-big+0, parameter-problem+0, parameter-problem+1 }
packet-too-big+0
parameter-problem+0
parameter-problem+1
At most 1000 packets per second, burst of 5 packets		Accept packet
#
Rule comment: Allow-IPSec-ESP
0 B
Traffic matched by rule: 0 Packets, 0 Bytes
IP protocol is esp		Continue in accept_to_lan
#
Rule comment: Allow-ISAKMP
0 B
Traffic matched by rule: 0 Packets, 0 Bytes
UDP destination port is 500		Continue in accept_to_lan
Any packetContinue in drop_to_wan

Rule container chain "accept_to_wan"

Rule matchesRule actions
No rules in this chain

Rule container chain "reject_from_wan"

Rule matchesRule actions
No rules in this chain

Rule container chain "drop_to_wan"

Rule matchesRule actions
No rules in this chain

Rule container chain "input_cognitum_tailnet"

Rule matchesRule actions
#
Rule comment: Cognitum tailnet HTTPS management
0 B
Traffic matched by rule: 0 Packets, 0 Bytes
TCP destination port is 443		Accept packet
Any packetContinue in reject_from_cognitum_tailnet

Rule container chain "output_cognitum_tailnet"

Rule matchesRule actions
Any packetContinue in accept_to_cognitum_tailnet

Rule container chain "forward_cognitum_tailnet"

Rule matchesRule actions
Any packetContinue in reject_to_cognitum_tailnet

Rule container chain "accept_to_cognitum_tailnet"

Rule matchesRule actions
#
Rule comment: accept cognitum_tailnet IPv4/IPv6 traffic
0 B
Traffic matched by rule: 0 Packets, 0 Bytes
Egress device name is tailscale0		Accept packet

Rule container chain "reject_from_cognitum_tailnet"

Rule matchesRule actions
#
Rule comment: reject cognitum_tailnet IPv4/IPv6 traffic
0 B
Traffic matched by rule: 0 Packets, 0 Bytes
Ingress device name is tailscale0		Continue in handle_reject

Rule container chain "reject_to_cognitum_tailnet"

Rule matchesRule actions
#
Rule comment: reject cognitum_tailnet IPv4/IPv6 traffic
0 B
Traffic matched by rule: 0 Packets, 0 Bytes
Egress device name is tailscale0		Continue in handle_reject

NAT action chain "dstnat"

  • Hook: prerouting (Capture incoming packets before any routing decision), Priority: -100
  • Policy: accept (Continue processing unmatched packets)
Rule matchesRule actions
No rules in this chain

NAT action chain "srcnat"

  • Hook: postrouting (Capture outgoing packets after any routing decision), Priority: 100
  • Policy: accept (Continue processing unmatched packets)
Rule matchesRule actions
No rules in this chain

Rule container chain "srcnat_wan"

Rule matchesRule actions
#
Rule comment: Masquerade IPv4 wan traffic
Address family is IPv4		Rewrite to egress device address

Traffic filter chain "raw_prerouting"

  • Hook: prerouting (Capture incoming packets before any routing decision), Priority: -300
  • Policy: accept (Continue processing unmatched packets)
Rule matchesRule actions
No rules in this chain

Traffic filter chain "raw_output"

  • Hook: output (Capture outgoing packets originating from the local system), Priority: -300
  • Policy: accept (Continue processing unmatched packets)
Rule matchesRule actions
No rules in this chain

Traffic filter chain "mangle_prerouting"

  • Hook: prerouting (Capture incoming packets before any routing decision), Priority: -150
  • Policy: accept (Continue processing unmatched packets)
Rule matchesRule actions
No rules in this chain

Traffic filter chain "mangle_postrouting"

  • Hook: postrouting (Capture outgoing packets after any routing decision), Priority: -150
  • Policy: accept (Continue processing unmatched packets)
Rule matchesRule actions
No rules in this chain

Traffic filter chain "mangle_input"

  • Hook: input (Capture incoming packets routed to the local system), Priority: -150
  • Policy: accept (Continue processing unmatched packets)
Rule matchesRule actions
No rules in this chain

Route action chain "mangle_output"

  • Hook: output (Capture outgoing packets originating from the local system), Priority: -150
  • Policy: accept (Continue processing unmatched packets)
Rule matchesRule actions
No rules in this chain

Traffic filter chain "mangle_forward"

  • Hook: forward (Capture incoming packets addressed to other hosts), Priority: -150
  • Policy: accept (Continue processing unmatched packets)
Rule matchesRule actions
No rules in this chain

eero · Powered by LuCI (HEAD detached at 128a7812) branch (26.180.75667~128a781)