Certain upstream switch to `firewall4` aka `nftables` instead of `iptables` #731

aparcar · 2021-10-06T05:50:47Z

Hi all, especially @openwrt/routing-write,

for the next OpenWrt release firewall4 is considered as a replacement of the current iptables based firewall package. While the configuration stays within /etc/config/firewall, packages using iptables directly may see trouble.

This is a heads up for everyone maintaining such packages but also please post packages here that would be affected so a smother migration is possible.

Compatible with firewall4:

OLSR

Heads up for packages.git: openwrt/packages#16818
Heads up for luci.git: openwrt/luci#5409

The text was updated successfully, but these errors were encountered:

PolynomialDivision · 2021-10-06T06:22:47Z

OLSR is affected.

pmelange · 2021-10-13T15:32:21Z

OLSR is affected.

with a git grep -i iptables i see that nodogsplash and opennds both require "iptables-mod-ipopt". What would be the equivalent package in fw4?

In OLSR, it seems like only olsrd/files/olsrd.sh is using iptables and ip6tables in a script. Is there a syntax change on the command line going from iptables to fw4?

I didn't look at any of the source code of any of the packages, just at the repo itself.

pmelange · 2021-10-13T15:47:18Z

I just did a git grep -i kmod-ipt and the following have kmod dependencies:

bmx6
bmx7

zioproto · 2021-10-17T07:05:20Z

@PolynomialDivision is it olsrd core code affected or it is an extension/plugin ? Is it just the Smart Gateway extension broken ?

aparcar · 2022-01-07T09:43:57Z

@openwrt/routing-write heads up, firewall4 gets into a fine state (thanks to @stintel and @jow- )and I'm planing to make it the default within the next week. For all scripts that require legacy iptables please test your apps with iptables-nft and report back!

bluewavenet · 2022-01-11T11:45:28Z

@aparcar
Where is iptables-nft? (It is probably hidden in clear sight, ie I can't find it :-D )
openNDS works fine with it on "Generic Linux" eg Debian, et al, so should be good here as well at least as an interim solution.

wfleurant · 2022-01-11T15:16:15Z

i found something in LuCI. When I Save & Apply a rule under "Traffic Rules" it does not restart the firewall.
when manually running /etc/init.d/firewall restart then all of the rules I enabled/disabled work as expected.
compiled against your aparcar/openwrt:fw4 (8af05a1) .. tested on rpi4

My fault, i didn't see the link to openwrt/luci#5409 -- Infinity Thanks @aparcar

castillofrancodamian · 2022-01-14T17:39:24Z

@aparcar Where is iptables-nft? (It is probably hidden in clear sight, ie I can't find it :-D ) openNDS works fine with it on "Generic Linux" eg Debian, et al, so should be good here as well at least as an interim solution.

The iptables-nft package is already there.

aparcar · 2022-01-19T08:31:57Z

As discussed at yesterdays meeting I merged the changes. The next release will use firewall4 as default and all packages incompatible (e.g. using ipset) should add a negative dependency. Our considerations are that the default (WiFI home router) setup works fine wir firewall4 and special cases can always replace firewall4 with firewall3, which should work at least until the upcoming 5.15 Kernels.

Firewall4 uses nftables instead of iptables. Use iptables-nft for installing smart-gw-rules. Fixes: openwrt#731 ("Certain upstream switch to firewall4 aka nftables instead of iptables") Signed-off-by: Nick Hainke <[email protected]>

PolynomialDivision · 2022-02-28T20:30:50Z

Firewall4 fails when adding:

config rule
        option name 'DSCP olsr'
        list proto 'udp'
        option dest 'freifunk'
        option dest_port '698'
        option target 'DSCP'
        option set_dscp 'EF'

/proc/self/fd/0:182:21-27: Error: Byteorder mismatch: expected big endian, got host endian

@jow-

jow- · 2022-03-01T14:28:18Z

Please attach the output of fw4 print. Looks like an nftables upstream bug though

PolynomialDivision · 2022-03-01T14:30:32Z

table inet fw4
flush table inet fw4

table inet fw4 {
	#
	# Set definitions
	#


	#
	# Defines
	#

	define freifunk_devices = { "switch0.42", "wlan5-mesh", "wg_*" }
	define freifunk_subnets = { 10.31.96.0/28, 2001:bf7:830:8901::/64, 10.31.96.16, 2001:bf7:830:89ff::1 }
	define dhcp_devices = { "br-dhcp" }
	define dhcp_subnets = { 10.31.142.128/25, 2001:bf7:830:8900::/64 }

	#
	# User includes
	#

	include "/etc/nftables.d/*.nft"


	#
	# Filter rules
	#

	chain input {
		type filter hook input priority filter; policy accept;

		iifname "lo" accept comment "!fw4: Accept traffic from loopback"

		ct state established,related accept comment "!fw4: Allow inbound established and related flows"
		tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "!fw4: Rate limit TCP syn packets"
		iifname "wg_*" jump input_freifunk comment "!fw4: Handle freifunk IPv4/IPv6 input traffic"
		iifname { "switch0.42", "wlan5-mesh" } jump input_freifunk comment "!fw4: Handle freifunk IPv4/IPv6 input traffic"
		iifname "br-dhcp" jump input_dhcp comment "!fw4: Handle dhcp IPv4/IPv6 input traffic"
	}

	chain forward {
		type filter hook forward priority filter; policy drop;

		ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
		iifname "wg_*" jump forward_freifunk comment "!fw4: Handle freifunk IPv4/IPv6 forward traffic"
		iifname { "switch0.42", "wlan5-mesh" } jump forward_freifunk comment "!fw4: Handle freifunk IPv4/IPv6 forward traffic"
		iifname "br-dhcp" jump forward_dhcp comment "!fw4: Handle dhcp IPv4/IPv6 forward traffic"
		jump handle_reject
	}

	chain output {
		type filter hook output priority filter; policy accept;

		oifname "lo" accept comment "!fw4: Accept traffic towards loopback"

		ct state established,related accept comment "!fw4: Allow outbound established and related flows"
		oifname "wg_*" jump output_freifunk comment "!fw4: Handle freifunk IPv4/IPv6 output traffic"
		oifname { "switch0.42", "wlan5-mesh" } jump output_freifunk comment "!fw4: Handle freifunk IPv4/IPv6 output traffic"
		oifname "br-dhcp" jump output_dhcp comment "!fw4: Handle dhcp IPv4/IPv6 output traffic"
	}

	chain handle_reject {
		meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
		reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
	}

	chain syn_flood {
		limit rate 25/second burst 50 packets return comment "!fw4: Accept SYN packets below rate-limit"
		drop comment "!fw4: Drop excess packets"
	}

	chain input_freifunk {
		jump accept_from_freifunk
	}

	chain output_freifunk {
		jump accept_to_freifunk
	}

	chain forward_freifunk {
		meta nfproto ipv6 icmpv6 type { 128, 129, 1, 3 } limit rate 1000/second counter jump accept_to_dhcp comment "!fw4: Allow-ICMPv6-Forward-dhcp"
		meta nfproto ipv6 icmpv6 type . icmpv6 code { 2 . 0, 4 . 0, 4 . 1 } limit rate 1000/second counter jump accept_to_dhcp comment "!fw4: Allow-ICMPv6-Forward-dhcp"
		jump accept_to_freifunk comment "!fw4: Accept freifunk to freifunk forwarding"
		jump reject_to_freifunk
	}

	chain accept_from_freifunk {
		iifname "wg_*" counter accept comment "!fw4: accept freifunk IPv4/IPv6 traffic"
		iifname { "switch0.42", "wlan5-mesh" } counter accept comment "!fw4: accept freifunk IPv4/IPv6 traffic"
	}

	chain accept_to_freifunk {
		oifname "wg_*" counter accept comment "!fw4: accept freifunk IPv4/IPv6 traffic"
		oifname { "switch0.42", "wlan5-mesh" } counter accept comment "!fw4: accept freifunk IPv4/IPv6 traffic"
	}

	chain reject_to_freifunk {
		oifname "wg_*" counter jump handle_reject comment "!fw4: reject freifunk IPv4/IPv6 traffic"
		oifname { "switch0.42", "wlan5-mesh" } counter jump handle_reject comment "!fw4: reject freifunk IPv4/IPv6 traffic"
	}

	chain input_dhcp {
		jump accept_from_dhcp
	}

	chain output_dhcp {
		jump accept_to_dhcp
	}

	chain forward_dhcp {
		jump accept_to_freifunk comment "!fw4: Accept dhcp to freifunk forwarding"
		jump reject_to_dhcp
	}

	chain accept_from_dhcp {
		iifname "br-dhcp" counter accept comment "!fw4: accept dhcp IPv4/IPv6 traffic"
	}

	chain accept_to_dhcp {
		oifname "br-dhcp" counter accept comment "!fw4: accept dhcp IPv4/IPv6 traffic"
	}

	chain reject_to_dhcp {
		oifname "br-dhcp" counter jump handle_reject comment "!fw4: reject dhcp IPv4/IPv6 traffic"
	}


	#
	# NAT rules
	#

	chain dstnat {
		type nat hook prerouting priority dstnat; policy accept;
	}

	chain srcnat {
		type nat hook postrouting priority srcnat; policy accept;
	}


	#
	# Raw rules (notrack & helper)
	#

	chain raw_prerouting {
		type filter hook prerouting priority raw; policy accept;
		iifname "wg_*" jump helper_freifunk comment "!fw4: freifunk IPv4/IPv6 CT helper assignment"
		iifname { "switch0.42", "wlan5-mesh" } jump helper_freifunk comment "!fw4: freifunk IPv4/IPv6 CT helper assignment"
		iifname "br-dhcp" jump helper_dhcp comment "!fw4: dhcp IPv4/IPv6 CT helper assignment"
	}

	chain raw_output {
		type filter hook output priority raw; policy accept;
	}

	chain helper_freifunk {
	}

	chain helper_dhcp {
	}


	#
	# Mangle rules
	#

	chain mangle_prerouting {
		type filter hook prerouting priority mangle; policy accept;
	}

	chain mangle_postrouting {
		type filter hook postrouting priority mangle; policy accept;
	}

	chain mangle_input {
		type filter hook input priority mangle; policy accept;
	}

	chain mangle_output {
		type filter hook output priority mangle; policy accept;
		meta nfproto ipv4 oifname { "switch0.42", "wlan5-mesh", "wg_*" } udp dport 698 counter ip dscp set 0x2e comment "!fw4: DSCP olsr"
		meta nfproto ipv6 oifname { "switch0.42", "wlan5-mesh", "wg_*" } udp dport 698 counter ip6 dscp set 0x2e comment "!fw4: DSCP olsr"
	}

	chain mangle_forward {
		type filter hook forward priority mangle; policy accept;
	}
}

dave14305 · 2022-03-01T15:29:57Z

Please attach the output of fw4 print. Looks like an nftables upstream bug though

Like this one?
http://git.netfilter.org/nftables/commit/?id=4788869a3346b5b3f1f6a3cdb12fdf79da961ef9

nftables 1.0.2 was released recently.

Firewall4 uses nftables instead of iptables. Use iptables-nft for installing smart-gw-rules. Fixes: openwrt#731 ("Certain upstream switch to firewall4 aka nftables instead of iptables") Signed-off-by: Nick Hainke <[email protected]>

Firewall4 will not ship iptables as default. However, we need iptables for installing smart-gw-rules. Instead of using the original iptables, we can also use iptables-nft: ... iptables-nft parses the iptables syntax on command line, creates appropriate nftables commands, packs them into netlink messages and submits them to kernel. https://www.redhat.com/en/blog/using-iptables-nft-hybrid-linux-firewall Since, commit 795e7155cbe3 ("iptables: rename to ip(6)tables-legacy, add PROVIDES") it is enough to include iptables as dependency to install iptables-nft [0]. iptables-nft also PROVIDES iptables. Fixes: openwrt#731 ("Certain upstream switch to firewall4 aka nftables instead of iptables") - [0] https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=795e7155cbe3e78669f6821bf7aecb7c4e1e1afbv Signed-off-by: Nick Hainke <[email protected]>

BKPepe · 2022-03-06T14:10:19Z

nftables 1.0.2 was released recently.

openwrt/openwrt#9402

PolynomialDivision · 2022-03-06T14:40:31Z

Sorry for closing. This was automatically done by merging a PR.

BKPepe · 2022-03-06T15:26:17Z

Why this was re-opened? It is not clear to me. OP issue was solved. The issue related to nftables or firewall4 should be moved to somewhere else. :)

PolynomialDivision · 2022-03-06T21:27:47Z

Probably @aparcar wants to decide when to close. ;)

aparcar · 2022-03-07T13:02:30Z

If OLSR is the only package affected by firewall4 this can be closed.

aparcar mentioned this issue Oct 6, 2021

[RFC/RFT] build: switch to firewall4 by default openwrt/openwrt#4642

Closed

6 tasks

This was referenced Oct 6, 2021

Certain upstream switch to firewall4 aka nftables instead of iptables openwrt/luci#5409

Open

Certain upstream switch to firewall4 aka nftables instead of iptables openwrt/packages#16818

Open

aparcar changed the title ~~Possible upstream switch to firewall4 aka nftables instead of iptables~~ Certain upstream switch to firewall4 aka nftables instead of iptables Jan 19, 2022

aparcar mentioned this issue Feb 15, 2022

[22.03] Upcoming release requirements openwrt/openwrt#9248

Open

5 tasks

PolynomialDivision mentioned this issue Feb 27, 2022

olsrd: switch to firewall4 #812

Merged

PolynomialDivision closed this as completed in #812 Mar 6, 2022

PolynomialDivision reopened this Mar 6, 2022

PolynomialDivision closed this as completed Mar 7, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Certain upstream switch to `firewall4` aka `nftables` instead of `iptables` #731

Certain upstream switch to `firewall4` aka `nftables` instead of `iptables` #731

aparcar commented Oct 6, 2021 •

edited by PolynomialDivision

Loading

PolynomialDivision commented Oct 6, 2021

pmelange commented Oct 13, 2021

pmelange commented Oct 13, 2021

zioproto commented Oct 17, 2021

aparcar commented Jan 7, 2022

bluewavenet commented Jan 11, 2022

wfleurant commented Jan 11, 2022 •

edited

Loading

castillofrancodamian commented Jan 14, 2022

aparcar commented Jan 19, 2022

PolynomialDivision commented Feb 28, 2022 •

edited

Loading

jow- commented Mar 1, 2022

PolynomialDivision commented Mar 1, 2022

dave14305 commented Mar 1, 2022

BKPepe commented Mar 6, 2022

PolynomialDivision commented Mar 6, 2022 •

edited

Loading

BKPepe commented Mar 6, 2022

PolynomialDivision commented Mar 6, 2022

aparcar commented Mar 7, 2022

Certain upstream switch to firewall4 aka nftables instead of iptables #731

Certain upstream switch to firewall4 aka nftables instead of iptables #731

Comments

aparcar commented Oct 6, 2021 • edited by PolynomialDivision Loading

PolynomialDivision commented Oct 6, 2021

pmelange commented Oct 13, 2021

pmelange commented Oct 13, 2021

zioproto commented Oct 17, 2021

aparcar commented Jan 7, 2022

bluewavenet commented Jan 11, 2022

wfleurant commented Jan 11, 2022 • edited Loading

castillofrancodamian commented Jan 14, 2022

aparcar commented Jan 19, 2022

PolynomialDivision commented Feb 28, 2022 • edited Loading

jow- commented Mar 1, 2022

PolynomialDivision commented Mar 1, 2022

dave14305 commented Mar 1, 2022

BKPepe commented Mar 6, 2022

PolynomialDivision commented Mar 6, 2022 • edited Loading

BKPepe commented Mar 6, 2022

PolynomialDivision commented Mar 6, 2022

aparcar commented Mar 7, 2022

Certain upstream switch to `firewall4` aka `nftables` instead of `iptables` #731

Certain upstream switch to `firewall4` aka `nftables` instead of `iptables` #731

aparcar commented Oct 6, 2021 •

edited by PolynomialDivision

Loading

wfleurant commented Jan 11, 2022 •

edited

Loading

PolynomialDivision commented Feb 28, 2022 •

edited

Loading

PolynomialDivision commented Mar 6, 2022 •

edited

Loading