tomato-guest-firewall.sh

#!/bin/sh
PORT_DHCP="67"
PORT_DNS="53"

STATE_NEW="-m state --state NEW"
REJECT="REJECT --reject-with icmp-host-prohibited"
REJECT_TCP="REJECT --reject-with tcp-reset"

# limit guests to essential router services (icmp echo/reply, dhcp, dns)
iptables -I INPUT         -i br1 $STATE_NEW -j $REJECT
iptables -I INPUT -p tcp  -i br1 $STATE_NEW -j $REJECT_TCP
iptables -I INPUT -p icmp -i br1 -j ACCEPT
iptables -I INPUT -p tcp  -i br1 --dport $PORT_DNS -j ACCEPT
iptables -I INPUT -p udp  -i br1 --dport $PORT_DNS -j ACCEPT
iptables -I INPUT -p udp  -i br1 --dport $PORT_DHCP -j ACCEPT

# deny access to private network by guests (internet only)
iptables -I FORWARD        -i br1 -o br0 $STATE_NEW -j $REJECT
iptables -I FORWARD -p tcp -i br1 -o br0 $STATE_NEW -j $REJECT_TCP

# deny access to guests by private network (optional)
iptables -I FORWARD        -i br0 -o br1 $STATE_NEW -j $REJECT
iptables -I FORWARD -p tcp -i br0 -o br1 $STATE_NEW -j $REJECT_TCP