Network Configuration & Firewall
Relevant source files
The following files were used as context for generating this wiki page:
LuCI Mobile manages OpenWrt network parameters and firewall policies through the LuCI RPC interface. The system allows users to inspect interface states, configure DHCP leases, and modify firewall zones or rules directly from a mobile device.
The application interacts with the router's Unified Configuration Interface (UCI) to perform administrative tasks such as reserving IP addresses, blocking specific clients, and managing port forwards. It ensures safety during configuration changes by using OpenWrt's apply-with-rollback protocol, which reverts changes if connectivity is lost.
Sources: README.md:14-38, README.md:42-47
Interface Management
The system tracks physical and virtual network devices, including bridges, wireless radios, and Ethernet interfaces. It categorizes interfaces into functional groups like lan, wan, and guest to apply specific routing and firewall logic.
Device and Interface Relationships
The following diagram illustrates how logical interfaces map to physical or virtual devices within the OpenWrt ecosystem.
The application retrieves real-time statistics and status for these devices, including MTU, MAC addresses, and traffic counters (rx_bytes/tx_bytes).
Sources: assets/mock/interface_dump.json:1-120, assets/mock/network_devices.json:1-60
Interface Properties
| Property | Description | Example |
|---|---|---|
proto | Connection protocol | dhcp, static, pppoe |
up | Current operational state | true / false |
device | Underlying hardware or bridge name | br-lan, eth0 |
ipv4-address | Assigned IP and subnet mask | 192.168.1.1/24 |
dns-server | Configured upstream DNS | 8.8.8.8 |
Sources: assets/mock/interface_dump.json:4-22, assets/mock/interface_dump.json:82-98
Firewall Configuration
The firewall module defines security zones and traffic rules. It defaults to a state where input and output are generally accepted, while forwarding is restricted unless explicitly permitted between zones.
Firewall Zones and Forwarding
Zones group network interfaces to simplify rule application. For example, the wan zone typically enables Masquerading (NAT) and MTU fixing.
Sources: assets/mock/uci_firewall.json:13-41
Client Blocking
LuCI Mobile creates specific named rules to block devices based on their MAC address. These rules are added to the UCI firewall configuration with a REJECT target.
"luci_mobile_block_ccddee98765a": {
".type": "rule",
"name": "Block Baby-Monitor (LuCI Mobile)",
"src": "lan",
"src_mac": "CC:DD:EE:98:76:54",
"dest": "*",
"target": "REJECT",
"enabled": "1"
}
Sources: assets/mock/uci_firewall.json:42-51, README.md:21-21
DHCP and Address Reservation
The DHCP system, managed via dnsmasq and odhcpd, handles dynamic IP assignment and static host hints.
DHCP Server Settings
Each interface can host a DHCP server with defined start/limit ranges and lease times.
- Interface
lan: Starts at.100, limit of150addresses,12hlease time. - Interface
wan: DHCP is ignored (client mode).
Sources: assets/mock/uci_dhcp.json:18-40
Static Leases (Host Configuration)
Static leases map a MAC address to a specific IP and hostname to ensure consistent addressing for servers or printers.
| Hostname | MAC Address | Fixed IP |
|---|---|---|
| Raspberry-Pi-Server | CC:DD:EE:DD:EE:FF | 192.168.1.120 |
| Printer-HP-Office | AA:BB:CC:98:76:54 | 192.168.1.107 |
Sources: assets/mock/uci_dhcp.json:49-62
Wireless Networking
Wireless configuration is split between wifi-device (hardware radio properties) and wifi-iface (SSID and security properties).
Radio and Interface Schema
The relationship between hardware radios and the SSIDs they broadcast is defined in the uci_wireless configuration.
Sources: assets/mock/uci_wireless.json:2-62
Summary
The Network Configuration & Firewall module provides a comprehensive abstraction of OpenWrt's underlying UCI files. By managing uci_firewall, uci_dhcp, and uci_wireless, the application enables mobile administration of complex routing, security, and connectivity tasks. All modifications are performed via LuCI RPC, ensuring that the router remains the source of truth while providing a safety net through the apply-with-rollback protocol.