CentOS - Aug 2016 - [CentOS6] Manually configured Firewall (WLAN-AP plus Router)

Hello

I've got this Mini-PC
https://www.zotac.com/product/mini_pcs/zbox-ci323-nano

everything is fine ->  latest 6.8 kernel works;
both Ethernet-Interfaces work and also the WLAN-Interface works;

the two Ethernet-Interfaces are eth0 and eth1
the WLAN-Interface is wlan0

eth1 is connected on ISP side
eth0 is connected on my LAN side to a switch;
and wlan0 shall also be on my LAN side f?r wireless and work as an Access-Point
(this works)

I want both LAN interfaces (eth0 and wlan0) have the same IP subnet
so I did this:
http://www.microhowto.info/howto/persistently_bridge_traffic_between_two_or_more_ethernet_interfaces_on_redhat.html

also the DHCP works fine: both DHCP and DHCPv6; RADVd also works fine;

in /etc/sysconfig/network-scripts/
I added ifcfg-sit1 with the configuration for my IPv6 tunnel at Hurricane
Electric
there is the following entry:  IPV6TUNNELIPV4LOCAL=ipv4addr
here the 1st question:
does this have to be the IPv4 address of br0 (LAN) or the one of eth1 (WAN)?
(before I had this on a virtual machine, there was only one interface, but here
...?)

and now the bigger problem:

here just the IP addresses for better troubleshooting;

the ISP installed a box (NAT router), that is a medium converter (coaxial cable
to ethernet twisted-pair cable), too;
this box has on WAN side, my public IP
an LAN side it has 192.168.0.1

this box which should be installed instead of my old NAT-router has the
following IP addresses
on device br0  192.168.1.100 (LAN) and on device eth1 (WAN) 192.168.0.127
the old router has on LAN side 192.168.1.254 and on WAN side 192.168.0.254
now both the new box and the old router are connected "parallel" which
means, each is connected with its WAN interfaces to the built-in switch of
ISP-box and with its LAN interfaces to my switch;

on the old NAT-router I have defined the LAN-IP of the new box as DHCP relay;
this works fine;
(the new box is the only DHCP server in LAN)

<begin /etc/sysconfig/iptables>
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]

# ICMP: extra chain
-N ALLOWED-ICMP
-A ALLOWED-ICMP -p icmp -m limit --limit 1/sec --limit-burst 2 -j ACCEPT

# Allow anything on the local link
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT

# Allow anything out on the localnet
-A OUTPUT -o br0 -j ACCEPT
# Allow established, related packets back in
-A INPUT -i br0 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Enable DHCP
-A INPUT -p udp -i br0 --dport 67:68 --sport 67:68 -j ACCEPT

# Enable IPv6
-A INPUT -p ipv6 -i eth1 -s 216.66.80.30 -j ACCEPT

# Allow SSH from LAN and redirected from internet
# from WLAN there should be no SSH possible, so I used eth0
-A INPUT -i eth0 -m tcp -p tcp --dport 22 -m state --state NEW -j ACCEPT
-A INPUT -i eth1 -d 192.168.0.127 -m tcp -p tcp --dport 22 -m state --state NEW
-m recent --update --seconds 115 --hitcount 3 --name DEFAULT --rsource -j DROP
-A INPUT -i eth1 -d 192.168.0.127 -m tcp -p tcp --dport 22 -m state --state NEW
-m recent --set --name DEFAULT --rsource
-A INPUT -i eth1 -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

# Allow anything out on the internet
-A OUTPUT -o eth1 -j ACCEPT
# Allow established, related packets back in
-A INPUT -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow multicast
-A INPUT -d 224.0.0.0/4 -j ACCEPT
-A OUTPUT -d 224.0.0.0/4 -j ACCEPT

# Allow Forwarding on LAN interfaces
-A FORWARD -i br0 -o br0 -d 192.168.1.0/24 -j ACCEPT
# Allow Forwarding to WAN interface
-A FORWARD -i eth0 -o eth1 -s 192.168.1.0/24 -j ACCEPT
-A FORWARD -i wlan0 -o eth1 -s 192.168.1.0/24 -j ACCEPT
# Allow established, related packets back through
-A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -i eth1 -o wlan0 -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -i eth1 -o eth0 -j LOG  --log-prefix "IP[FWD-Reply]: "
--log-level 7
-A FORWARD -i eth1 -o wlan0 -j LOG  --log-prefix "IP[FWD-Reply]: "
--log-level 7

# Only pings with restricted icmp are allowed
-A INPUT -i eth1 -p icmp -j ALLOWED-ICMP

# Enable TRACEroute to me
-I INPUT -i eth1 -p udp -d 192.168.0.127 --sport 32769:65535 --dport 33434:33523
-j ACCEPT

# Enable SSH to me
-I INPUT -i eth1 -p tcp -d 192.168.0.127 --dport 22 -j ACCEPT

# Log all other
-A INPUT -j LOG --log-prefix "IP[IN]: " --log-level 7
-A FORWARD -j LOG  --log-prefix "IP[FWD]: " --log-level 7
-A OUTPUT -j LOG  --log-prefix "IP[OUT]: " --log-level 7

COMMIT
<end /etc/sysconfig/iptables>

I have several virtual machines which have configured the old NAT-router als
gateway; they all work fine; one virtual machine (OS = Win7) has the new box
configured as gateway with IP address 192.168.1.6

I have a old notebook (OS = WinXP) that is "connected" via WLAN to the
new box and this has 192.168.1.4 as IP address; both can ping each other the VM
and this notebook;

here the questions:
should I use eth0 and wlan0 or br0 in the iptables and ip6tables roules?
why is it possible to ping the VM or the notebook from the new box, but not the
other way?

Thanks for any help;

Greetings,
Walter