OpenWrt Firewall Relationship Visualiser

📥 Import

Supported inputs: host lists, ip neighbour, arp -a, cat /tmp/dhcp.leases, and CSV from scripts/openwrt_export_hosts.sh.

scp scripts/openwrt_export_hosts.sh root@172.16.0.1:/tmp/
ssh root@172.16.0.1 sh /tmp/openwrt_export_hosts.sh

The script output format is ip,hostname,zone,mac.

No hosts imported yet.

Import Session / Devices

Recommended source file: /etc/config/firewall

On OpenWrt, run:

cat /etc/config/firewall

Then paste the output below.

Alternative:

scp root@172.16.0.1:/etc/config/firewall ./openwrt_firewall.conf

This webpage does not SSH into your router. It only parses text you paste or upload locally.

Map real devices to firewall zones, or use the import section above to populate them in bulk.

Purpose: subnet mappings are only used to infer a host's firewall zone when imported host data does not already include a zone.

Manual format:

172.16.10.0/24 lan
172.16.20.0/24 iot
172.16.30.0/24 guest

Use the network address, not the router address. For example, use 172.16.20.0/24 iot, not 172.16.20.1/24 iot.

For OpenWrt UCI import, paste the output of these commands into the UCI box:

uci show firewall | grep -E "\.(name|network)="
uci show network | grep -E "\.(ipaddr|netmask)="

Helper script:

scp scripts/openwrt_export_subnet_mappings.sh root@172.16.0.1:/tmp/
ssh root@172.16.0.1 sh /tmp/openwrt_export_subnet_mappings.sh

This is separate from the firewall config parser. The main firewall box still expects /etc/config/firewall.

No UCI subnet import run yet.

Zone Device Allowed Blocked Device belongs to zone

➡️

Select two devices and test whether traffic is allowed.