What would you add to a 1.0.7.8 firmware image

[kfurge]

Yes, i want ftp from the LAN side, but there's no possibility to close FTP to WAN by the webinterface, so I (must still) manually delete the rule from the input-chain after every reboot

Thank you for the information. If it's possible, I'll keep my image from opening up this huge gaping security hole.

Regarding your manual delete rule, I have a similar problem where I want to add a rule for ssh access. You might be able to modify the following script to kill the offending line and plop it into rc.local, outside of any checks that limit execution to just at power-up.

#!/opt/bin/bash

lines=`/usr/sbin/iptables --list | /opt/bin/grep dpt:ssh | /opt/bin/wc -l`

if test $lines -eq "1"; then
iptables -I INPUT -p tcp --dport 22 -j ACCEPT
fi

FYI, rc.local gets called at boot-up and any time the configuration changes.

- K.C.