---
# This device is a pure AP — no routing, no NAT, no internet-facing interface.
#
# Zones:
#   mgmt  — management interface (192.168.255.11)
#           input: ACCEPT  (SSH, ping reachable from MGMT network)
#           forward: REJECT (nothing routes through mgmt)
#
#   lan   — client bridge (eth0.2, LAN ports)
#           input: REJECT  (clients cannot SSH into the AP itself)
#           forward: ACCEPT (traffic passes through to MikroTik for firewalling)
#
#   iot   — IoT bridge (eth0.5, wifi only)
#           input: REJECT  (IoT devices cannot reach the AP itself)
#           forward: ACCEPT (traffic passes through to MikroTik, which allows
#                            internet only and blocks all internal networks)
#
# No forwarding rules between zones — all inter-zone policy is on MikroTik.

- name: Configure firewall
  community.openwrt.uci:
    command: import
    merge: false
    config: firewall
    value: |
      package firewall

      config defaults
        option syn_flood '1'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

      config zone
        option name 'mgmt'
        list network 'mgmt'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

      config zone
        option name 'lan'
        list network 'lan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

      config zone
        option name 'iot'
        list network 'iot'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

      config rule
        option name 'Allow-ICMP-mgmt'
        option src 'mgmt'
        option proto 'icmp'
        option target 'ACCEPT'

  notify: Reload firewall