OpenWrt Proxy Firewall Paths: INPUT, OUTPUT and FORWARD
Separate client access to the router’s proxy listener from the proxy’s own egress and direct client forwarding.
When the router itself runs the web proxy, a proxied request uses two TCP connections. It is not simply the client’s connection being forwarded unchanged through the router.
| Traffic | Firewall path on the router |
|---|---|
| Client to the router’s proxy listener | INPUT |
| Proxy process to the website | OUTPUT |
| Client directly to an internet destination | FORWARD |
To require the explicit proxy route, permit intended clients to reach the listener and permit the proxy’s required outward connections. Restrict unwanted direct LAN-to-WAN forwarding separately.
Changing the router’s INPUT policy alone does not describe the direct forwarded path. Conversely, allowing the listener’s port in FORWARD does not necessarily allow access to a service terminating on the router.
Preserve the local services the network still needs, such as its chosen DNS and address configuration. Apply the policy to the address families actually in use. An HTTP proxy provides its supported web or tunnel operations; the firewall does not convert arbitrary UDP or ICMP into that protocol.