22.03.0-rc1 nftables/fw4 migration guide?

22.03.0-rc1 is now on the download pages, so it'll start getting some early adopter attention (such as me).
With the switch to nftables (fw4), is there a migration guide in the works for custom rules?
My initial questions:

  • LuCI has two Firewall status sections in 22.03.0-rc1, Firewall (iptables) and Firewall (nftables). Should they both be there?
  • With previous releases using fw3/iptables, I have a custom script that installs a NAT6 rule for my ULA prefix for VPNs when forwarding via an HE tunnel:
    ip6tables -t nat -A POSTROUTING -s {ULA_PREFIX} -o 6in4-wan6 -j MASQUERADE
    This rule in the iptables/fw3 days required kmod-ipt-nat6. Is this kernel module specific to iptables, or does it still apply for nftables? What module (if any) do I need for the equivalent nftables rule that I will put into /etc/nftables.d/<something>.nft:
chain srcnat_ula6_vpn {
  type nat hook postrouting priority srcnat; policy accept;
  oifname $wan_devices counter ip6 saddr {ULA_PREFIX} masquerade comment "!fw4: ULA masquerade6"
  • Generally, any guidance on migrating custom rules, either those included in /etc/firewall.user or equivalent include rules in /etc/config/firewall, or custom rules that have extra iptables arguments (in the extra field of a rule)
1 Like

That would be nice. Maybe there is one?
Anyway a few important points:

  • fw4 is not nftables. fw4 uses nftables (whereas fw3 uses iptables)
  • 22.03.0 onwards does not have the iptables package installed by default.
  • The package iptables-nft is fully compatible with nftables and actually uses nftables underneath. It provides the command "iptables" so old iptables scripts can still be used.
  • 22.03 has a bug. If you install "iptables", you would think you would get the nftables compatible version, but instead you get the old version - iptables-legacy. this will work, sort of, but can cause all sorts of problems as it does not talk to nftables so you can get conflicts. You have to manually install iptables-nft, but be aware it is possible (incorrectly) to have both iptables-legacy and iptables-nft - very bad.
  • If you make sure only iptables-nft is installed (and/or ip6tables-nft if needed), then any of your iptables scripts should run without having to make any changes. If fw4 just executes custom scripts like fw3 did then it should be ok. You can install kmod-ipt-nat6 etc as required.

Do the include clauses in the firewall config still work in 22.03?
such as:

# uci show firewall.@include[0]

Or, if include doesn't work anymore, where would one put a script (containing iptables commands or other things) to get executed when the firewall configuration is reloaded?

(answering myself) it appears that kmod-nft-nat6 is installed by default, at least it is in my imagebuilder output without me having to list it in my package list, so that rule will work without requiring additonal packages. But maybe I have some other package in my list that depends on kmod-nft-nat6 indirectly?

I don't know, but perhaps the syntax is different. Perhaps you could try it....

kmod-ipt-nat6 uses ip6tables-nft
kmod-nft-nat6 uses nf6tables

Maybe fw4?

I checked the x86_64 default build, it has kmod-nft-nat6 installed by default, so the end result is that I don't have to install anything extra to get a functioning NAT6 rule.

I don't have to install anything extra to get a functioning NAT6 rule.

Only if you set the rule using fw4 or nft6ables.

Tried the same syntax rules, and confirmed that include is not processed anymore, so that's something needed for migration: advice on where to put the commands that were in included files. They could be more than just iptables, it can be other things like logger or additional programs to run.

I just tried here too. Includes do not work....

I'm installing luci-app-sqm, which indirectly pulls in iptables-nft, so thankfully I didn't trip on this problem!

1 Like

Some firewall migration information is in notes in the release announcement: OpenWrt 22.03.0-rc1 first release candidate - #24 by jow