Ethernet/USB Tethering: Transition from iptables to nftables

Installing and Using OpenWrt Network and Wireless Configuration
1

Hello everyone, first time poster.

USB Tethering does only that, doesn't mention Ethernet tethering. Probably a non-issue since in that case it should work like any other WAN.

My issue is with TTL. Although it should, that doc doesn't address it.

I found this guide, and this other one (Scroll to where it says " 2. Spoof TTL & HL"). That second one handles ttl values better since it doesn't guess, it simply increases it by 2 to account for router and connected devices, see below:

# Removes these iptables entries if present; only removes once, so if the same entry is present twice (script assumes this never happens), it would need to be removed twice.
iptables -t mangle -D PREROUTING -i usb+ -j TTL --ttl-inc 2
iptables -t mangle -D POSTROUTING -o usb+ -j TTL --ttl-inc 2
ip6tables -t mangle -D PREROUTING ! -p icmpv6 -i usb+ -j HL --hl-inc 2
ip6tables -t mangle -D POSTROUTING ! -p icmpv6 -o usb+ -j HL --hl-inc 2

# Bypass TTL & HL detections for hotspot/tethering.
## Increments the TTL & HL by 2 (1 for the router, 1 for the devices connected to the router).
iptables -t mangle -I PREROUTING -i usb+ -j TTL --ttl-inc 2
iptables -t mangle -I POSTROUTING -o usb+ -j TTL --ttl-inc 2
ip6tables -t mangle -I PREROUTING ! -p icmpv6 -i usb+ -j HL --hl-inc 2
ip6tables -t mangle -I POSTROUTING ! -p icmpv6 -o usb+ -j HL --hl-inc 2

I'm going to asume it should be increased by 1 instead of 2 if it's bridged like in the first link. Point is, I don't know how I would go about doing this via the web interface and I don't want to rely on incompatible rules and legacy software.

Please help, thank you.

2

try adding net.ipv4.ip_default_ttl=[value] to /etc/sysctl.conf instead ...

3

Thank you for responding @frollic

Can it be formatted so that it increases TTL by 2 instead of defining it? Out of curiosity, don't know if it varies by carrier or region.

How does it differentiate from the iptables example? They increase it pre and post routing, whereas your one-line solution applies to outgoing ipv4 on all interfaces.

I'm going to try your solution tomorrow and combine it with other firewall rules and DNS changes. Should work.