Hi,
Forum noob here, but long time RutOS/OpenWrt user. I can’t find a similar problem in the forum archives, but please feel free to call me names and point me in the direction of the answer if I’m covering an old subject 
Context
- RUTX11
- RUTX_R_00.07.24.6
- firewall setup with wan with 3 internal zones
- wan - external pppoe with static IP, maps to network.wan ( # uci show network)
- mgmt - device br-lan IP x.x.1.1/24, maps to network.lan
- domestic - device eth0.16 IP x.x.16.1/24, maps to network.lan1
- iot - device eth0.42 IP x.x.42.1/24, maps to network.lan2
Problem
Using the webUI to add a firewall forwarding rule to DNAT inbound traffic from wan to iot zone results in addition of a rule that appears to map traffic into the lan zone, when it should be mapping the traffic to iot zone.Attempting to enable the rule via the webUI results in the rule getting stuck at “starting” status.
More broadly adding a forwarding rule with a destination in any zone adds the rule with lan as destination zone
Investigating
root@xxxx:~# fw3 print
Warning: Section '45' refers to not existing zone 'lan'
<snip/>
root@xxxx:\~# uci show firewall.45
firewall.45=redirect
firewall.45.dest='lan'
firewall.45.src='wan'
firewall.45.dest_ip='xx.xx.42.20'
firewall.45.target='DNAT'
firewall.45.src_dport='8888'
firewall.45.name='mqtts_2'
firewall.45.proto='tcp'
firewall.45.enabled='0'
Correcting the config
uci set firewall.45.dest='iot'
firewall.45.enabled='1'
uci commit
back on the webUI, the config looks correct (the right zone is associated with the rule) and can be enabled and disabled successfully via the webUI.
Am I doing something wrong?
Has it got something to do with changing the firewall zone names from the defaults ?
Perhaps the interfaces associated with the zones (the first is a bridge, the the two are vlan interfaces)?
Hopefully wiser heads, or folks with access to the source here on the forum can help.
Thanks