我从以下位置安装了 Openwrt 10.03.1： openwrt-ar71xx-wrt160nl-squashfs-factory.bin （仅使用此自定义防火墙： sed 's/REJECT/DROP/g' /etc/config/firewall） - 所以除此之外，这是默认的 OpenWRT 安装
我的 3 个客户端有 3 个 SSID。这是WRT160NL。
它通过 pppoe 连接到互联网，因此 pppoe-wan 是 WAN 接口（实际上“eth1”是 WAN 接口，电缆插入该端口）。
所以我把接下来的内容打印在纸上：
iptables-保存
root@OPENWRT:~# iptables-save
# Generated by iptables-save v1.4.6 on Wed Nov 21 16:59:23 2012
*nat
:PREROUTING ACCEPT [282:28098]
:POSTROUTING ACCEPT [12:748]
:OUTPUT ACCEPT [170:12487]
:nat_reflection_in - [0:0]
:nat_reflection_out - [0:0]
:postrouting_rule - [0:0]
:prerouting_lan - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan - [0:0]
:zone_lan_nat - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_nat - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -j prerouting_rule
-A PREROUTING -i br-lan -j zone_lan_prerouting
-A PREROUTING -i pppoe-wan -j zone_wan_prerouting
-A POSTROUTING -j postrouting_rule
-A POSTROUTING -o br-lan -j zone_lan_nat
-A POSTROUTING -o pppoe-wan -j zone_wan_nat
-A postrouting_rule -j nat_reflection_out
-A prerouting_rule -j nat_reflection_in
-A zone_lan_prerouting -j prerouting_lan
-A zone_wan_nat -j MASQUERADE
-A zone_wan_prerouting -j prerouting_wan
COMMIT
# Completed on Wed Nov 21 16:59:23 2012
# Generated by iptables-save v1.4.6 on Wed Nov 21 16:59:23 2012
*raw
:PREROUTING ACCEPT [88762:5585776]
:OUTPUT ACCEPT [32677:185865297]
:zone_lan_notrack - [0:0]
:zone_wan_notrack - [0:0]
-A PREROUTING -i br-lan -j zone_lan_notrack
-A PREROUTING -i pppoe-wan -j zone_wan_notrack
COMMIT
# Completed on Wed Nov 21 16:59:23 2012
# Generated by iptables-save v1.4.6 on Wed Nov 21 16:59:23 2012
*mangle
:PREROUTING ACCEPT [88762:5585776]
:INPUT ACCEPT [86059:4425898]
:FORWARD ACCEPT [2664:1156339]
:OUTPUT ACCEPT [32677:185865297]
:POSTROUTING ACCEPT [35338:187021465]
:zone_wan_MSSFIX - [0:0]
-A FORWARD -j zone_wan_MSSFIX
-A zone_wan_MSSFIX -o pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Wed Nov 21 16:59:23 2012
# Generated by iptables-save v1.4.6 on Wed Nov 21 16:59:23 2012
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:forward - [0:0]
:forwarding_lan - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan - [0:0]
:input - [0:0]
:input_lan - [0:0]
:input_rule - [0:0]
:input_wan - [0:0]
:nat_reflection_fwd - [0:0]
:output - [0:0]
:output_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_lan - [0:0]
:zone_lan_ACCEPT - [0:0]
:zone_lan_DROP - [0:0]
:zone_lan_REJECT - [0:0]
:zone_lan_forward - [0:0]
:zone_wan - [0:0]
:zone_wan_ACCEPT - [0:0]
:zone_wan_DROP - [0:0]
:zone_wan_REJECT - [0:0]
:zone_wan_forward - [0:0]
-A INPUT -m state --state INVALID -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j syn_flood
-A INPUT -j input_rule
-A INPUT -j input
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j forwarding_rule
-A FORWARD -j forward
-A OUTPUT -m state --state INVALID -j DROP
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -j output_rule
-A OUTPUT -j output
-A forward -i br-lan -j zone_lan_forward
-A forward -i pppoe-wan -j zone_wan_forward
-A forwarding_rule -j nat_reflection_fwd
-A input -i br-lan -j zone_lan
-A input -i pppoe-wan -j zone_wan
-A output -j zone_lan_ACCEPT
-A output -j zone_wan_ACCEPT
-A reject -p tcp -j REJECT --reject-with tcp-reset
-A reject -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -j RETURN
-A syn_flood -j DROP
-A zone_lan -j input_lan
-A zone_lan -j zone_lan_ACCEPT
-A zone_lan_ACCEPT -o br-lan -j ACCEPT
-A zone_lan_ACCEPT -i br-lan -j ACCEPT
**-A zone_lan_DROP -o br-lan -j DROP**
**-A zone_lan_DROP -i br-lan -j DROP**
**-A zone_lan_REJECT -o br-lan -j reject**
**-A zone_lan_REJECT -i br-lan -j reject**
-A zone_lan_forward -j zone_wan_ACCEPT
-A zone_lan_forward -j forwarding_lan
-A zone_lan_forward -j zone_lan_DROP
-A zone_wan -p udp -m udp --dport 68 -j ACCEPT
-A zone_wan -p icmp -m icmp --icmp-type 8 -j DROP
-A zone_wan -j input_wan
-A zone_wan -j zone_wan_DROP
-A zone_wan_ACCEPT -o pppoe-wan -j ACCEPT
-A zone_wan_ACCEPT -i pppoe-wan -j ACCEPT
-A zone_wan_DROP -o pppoe-wan -j DROP
-A zone_wan_DROP -i pppoe-wan -j DROP
-A zone_wan_REJECT -o pppoe-wan -j reject
-A zone_wan_REJECT -i pppoe-wan -j reject
-A zone_wan_forward -j forwarding_wan
-A zone_wan_forward -j zone_wan_DROP
COMMIT
# Completed on Wed Nov 21 16:59:23 2012
root@OPENWRT:~#
如果配置
root@OPENWRT:~# ifconfig
br-lan Link encap:Ethernet HWaddr AA:AA:AA:AA:AA:AA
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:87174 errors:0 dropped:0 overruns:0 frame:0
TX packets:137186 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:4532245 (4.3 MiB) TX bytes:192952659 (184.0 MiB)
eth0 Link encap:Ethernet HWaddr AA:AA:AA:AA:AA:AA
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:16 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:2578 (2.5 KiB)
Interrupt:4
eth1 Link encap:Ethernet HWaddr BB:BB:BB:BB:BB:BB
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:3661 errors:0 dropped:0 overruns:0 frame:0
TX packets:3447 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1221049 (1.1 MiB) TX bytes:224533 (219.2 KiB)
Interrupt:5
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:24 errors:0 dropped:0 overruns:0 frame:0
TX packets:24 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2088 (2.0 KiB) TX bytes:2088 (2.0 KiB)
mon.wlan0 Link encap:UNSPEC HWaddr CC-CC-CC-CC-CC-C1-00-00-00-00-00-00-00-00-00-00
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:263 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:32
RX bytes:20929 (20.4 KiB) TX bytes:0 (0.0 B)
pppoe-wan Link encap:Point-to-Point Protocol
inet addr:1.2.3.4 P-t-P:10.0.0.1 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1492 Metric:1
RX packets:1646 errors:0 dropped:0 overruns:0 frame:0
TX packets:1448 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:1063783 (1.0 MiB) TX bytes:132628 (129.5 KiB)
wlan0 Link encap:Ethernet HWaddr CC:CC:CC:CC:CC:C1
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:16 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:32
RX bytes:0 (0.0 B) TX bytes:2850 (2.7 KiB)
wlan0-1 Link encap:Ethernet HWaddr CC:CC:CC:CC:CC:C2
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:16 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:32
RX bytes:0 (0.0 B) TX bytes:2850 (2.7 KiB)
wlan0-2 Link encap:Ethernet HWaddr CC:CC:CC:CC:CC:C3
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:16 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:32
RX bytes:0 (0.0 B) TX bytes:2850 (2.7 KiB)
brctl显示
root@OPENWRT:~# brctl show
bridge name bridge id STP enabled interfaces
br-lan 8000.129ce121c98e no eth0
wlan0
wlan0-1
wlan0-2
root@OPENWRT:~#
……仔细观察几次。我发现了一些我不明白的事情：
1）
这些规则据我所知完全没用，我对此很确定，所以对此没有真正的问题，至少有一个“修复我”。
-A zone_lan_DROP -o br-lan -j DROP
-A zone_lan_DROP -i br-lan -j DROP
-A zone_lan_REJECT -o br-lan -j拒绝
-A zone_lan_REJECT -i br-lan -j拒绝
2）
真正的问题是...为什么有这么多桌子？
nat_reflection_in、nat_reflection_out、postrouting_rule、prerouting_lan、prerouting_rule、prerouting_wan、zone_lan_nat、zone_lan_prerouting、zone_wan_nat、zone_wan_prerouting、zone_lan、zone_lan_forward、zone_wan、zone_wan_forward 等。
没有表格就不能制定规则吗？ OpenWrt路由器的CPU通常都很小，为什么要使用复杂的规则呢？为什么不更简单一点呢？没有桌子？
3）
...如果没有人能提出一个好的答案，为什么需要这些表......那么据我所知，我将刷新所有规则等，并手动完成......以更简单的方式方式..
答案1
1）这些规则据我所知完全没用，我对此很确定，所以对此没有真正的问题，至少有一个“修复我”。
不，这些规则很有用。如果你告诉我为什么你认为它们没用，我会告诉你为什么。
好吧，我开玩笑的，你想不想我都会告诉你。这些规则的目的是保持设计简单。简单性不是通过规则的数量来衡量的。这些规则是有方法的。每个表都有一个简单易懂的用途，其名称显而易见。碰巧的是在默认配置下有些表只有一条规则。 OpenWRT 中需要更复杂的代码来优化单规则表。这也将使系统管理员在不通过这个假设的编译器的情况下调整规则变得更加困难。
2）真正的问题是......为什么有这么多表？
这些表对应于 OpenWRT 防火墙设置的功能。您可以减少规则，但这样您就会失去对某些用户有用的功能。
没有表格就不能制定规则吗？ OpenWrt路由器的CPU通常都很小，为什么要使用复杂的规则呢？为什么不更简单一点呢？没有桌子？
毫无疑问你可以使你自己的配置使用更少的表（除非您的防火墙非常简单，否则您可能最终会创建一些表）。 OpenWRT 更加灵活，因为它可以容纳许多用户。
规则的数量与CPU速度或RAM大小无关。表数量的影响与通过它们所需的时间几乎不相关 - 相反，拥有更多的表和每个表更少的规则意味着每个数据包经过的路径会更短（拥有更宽的树有助于让它不那么深）。对内存的影响可以忽略不计：每个表几百字节，而 RAM 则只有几兆字节。