jow-:

There's two issues preventing your rule to work with the current firewall implementation.

1. "option extra" has no support for "-i", "-o", "-s" or "-d".

So far, only match specific options were allowed in "option extra" which causes your
rule to get rejected with "Bad argument" during parsing.

A workaround is to use "option dest wan" instead.

Support for "-i", "-o", "-s" and "-d" has now been added to upstream firewall3.git with http://git.lede-project.org/0e5dd73

2. "option src_ip" must have no space between the "!" and the IP address.

Since "option src_ip" is parsed as space separated list for "config rule" sections,
your "option src_ip '! 192.168.1.0/24'" is interpreted as list src_ip '!'
list src_ip '192.168.1.0/24' which leads to an error like Warning: Option @rule[0].src_ip has invalid value '!'

A workaround is to remove the space between the exclamation mark and the address.

A fix for this parsing behavior has been added to upstream firewall3.git with http://git.lede-project.org/3d2c18a

lleachii:

Jo-Philipp,

The work around (removing the space) places the rule on my iptables!

It seems to hit all packets, but calls the thats WAN's drop chain. I see zero drops, which is expected (since I have a Custom RAW table rule dropping incoming from the LAN bridge also not equaling the SRC address).

I will test the space parsing in the next release.

Thanks!