Firewall Include Silently Ignored

Installing and Using OpenWrt
1

Hey,

I'm trying to log all outbound DNS connections. I followed the example fw4 include in the wiki.

/etc/config/firewall:

config include
        option type 'nftables'
        option fw4_compatible '1'
        option path '/etc/logging.nft'
        option position 'chain-pre'
        option chain 'accept_to_wan'

/etc/logging.nft:

tcp dport 53 log prefix "Outbound DNS TCP: "
udp dport 53 log prefix "Outbound DNS UDP: "
tcp dport 853 log prefix "Outbound DNS DoT: "
udp dport 853 log prefix "Outbound DNS DoQ: "

uci show firewall shows the include. However when running /etc/init.d/firewall restart the rules were not loaded.
fw4 print:

        chain accept_to_wan {
                meta nfproto ipv4 oifname { "pppoe-wan", "usb0" } ct state invalid counter drop comment "!fw4: Prevent NAT leakage"
                oifname { "pppoe-wan", "usb0" } counter accept comment "!fw4: accept wan IPv4/IPv6 traffic"
        }

When I insert the rules manually in nft via command

nft insert rule inet fw4 accept_to_wan tcp dport 53 log prefix \"Outbound DNS: \"

they appear in nft list ruleset and work as intended.

What am I doing wrong, why is fw4 ignoring my include?

2

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/firewall
nft list ruleset
fw4 print
3

ubus call system board:

{
        "kernel": "5.15.162",
        "hostname": "ladon.internal",
        "system": "ARMv7 Processor rev 1 (v7l)",
        "model": "Linksys WRT1200AC",
        "board_name": "linksys,wrt1200ac",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.4",
                "revision": "r24012-d8dd03c46f",
                "target": "mvebu/cortexa9",
                "description": "OpenWrt 23.05.4 r24012-d8dd03c46f"
        }
}

/etc/config/network:

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdXX:XXXX:XXXX::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '64'
        option ip6hint '0'

config device
        option name 'wan'
        option macaddr 'XX:XX:XX:XX:XX:XX'

config interface 'wan'
        option proto 'pppoe'
        option ipv6 'auto'
        option username 'XXXXXXXXXXXXXXX@XXXXXXXX'
        option password 'XXXXXXX'
        option device 'wan.7'

config interface 'seclan'
        option proto 'static'
        option device 'lan4'
        option ip6assign '64'
        option ip6hint '2'
        list ipaddr '192.168.2.1/24'

config device
        option type 'bridge'
        option name 'br-guestwlan'

config interface 'guestwlan'
        option proto 'static'
        option device 'br-guestwlan'
        option ipaddr '192.168.179.1'
        option netmask '255.255.255.0'
        option ip6assign '64'
        option ip6hint '1'

config interface 'voiplan'
        option proto 'static'
        option device 'lan3'
        option ipaddr '192.168.4.1'
        option netmask '255.255.255.0'
        option delegate '0'

config interface 'entlan'
        option proto 'static'
        option device 'lan2'
        option ip6assign '64'
        option ip6hint '3'
        list ipaddr '192.168.178.1/24'

config interface 'tether'
        option proto 'dhcp'
        option device 'usb0'

config interface 'tether6'
        option proto 'dhcpv6'
        option device 'usb0'
        option reqaddress 'try'
        option reqprefix 'auto'

config device
        option name 'usb0'
        option mtu '1472'
        option mtu6 '1472'

config interface 'mgmt'
        option proto 'static'
        option device 'wan'
        option ipaddr '192.168.100.2'
        option netmask '255.255.255.0'
        option gateway '192.168.100.1'
        option delegate '0'
        option defaultroute '0'

/etc/config/firewall (I removed all rule blocks that have a src of voiplan, entlan, seclan or guestwlan because the full file was 750 lines):


config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'
        option drop_invalid '1'

config zone
        option name 'lan'
        option output 'ACCEPT'
        option forward 'REJECT'
        option input 'REJECT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'tether'
        list network 'tether6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'
        option enabled '0'

config zone
        option name 'seclan'
        option output 'ACCEPT'
        option forward 'REJECT'
        option input 'REJECT'
        list network 'seclan'

config zone
        option name 'guestwlan'
        option output 'ACCEPT'
        option forward 'REJECT'
        option input 'REJECT'
        list network 'guestwlan'

config forwarding
        option src 'seclan'
        option dest 'wan'

config forwarding
        option src 'guestwlan'
        option dest 'wan'

config zone
        option name 'voiplan'
        option output 'ACCEPT'
        option forward 'REJECT'
        option input 'REJECT'
        list network 'voiplan'

config forwarding
        option src 'voiplan'
        option dest 'wan'

config rule
        option name 'LAN-Allow-DNS'
        option src 'lan'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'LAN-Allow-NTP'
        list proto 'udp'
        option src 'lan'
        option dest_port '123'
        option target 'ACCEPT'

config rule
        option name 'LAN-Allow-HTTP'
        list proto 'tcp'
        option src 'lan'
        option dest_port '80'
        option target 'ACCEPT'

config rule
        option name 'LAN-Allow-HTTPS'
        list proto 'tcp'
        option src 'lan'
        option dest_port '443'
        option target 'ACCEPT'

config rule
        option name 'LAN-Allow-SSH'
        list proto 'tcp'
        option src 'lan'
        option dest_port '9771'
        option target 'ACCEPT'

config rule
        option name 'LAN-Allow-UPnP'
        list proto 'tcp'
        option src 'lan'
        option dest_port '5000'
        option target 'ACCEPT'

config rule
        list proto 'udp'
        option src 'lan'
        option dest_port '1900'
        option target 'ACCEPT'
        option name 'LAN-Allow-UPnP-IGD'

config rule
        option name 'LAN-Allow-NAT-PMP'
        list proto 'udp'
        option src 'lan'
        option dest_port '5351'
        option target 'ACCEPT'

config rule
        option name 'LAN-Allow-DHCP'
        option family 'ipv4'
        list proto 'udp'
        option src 'lan'
        option src_port '68'
        option dest_port '67'
        option target 'ACCEPT'

config rule
        option name 'LAN-Allow-DHCPv6'
        option family 'ipv6'
        list proto 'udp'
        option src 'lan'
        option src_port '546'
        option dest_port '547'
        option target 'ACCEPT'

config rule
        option name 'LAN-Allow-Ping'
        option family 'ipv4'
        list proto 'icmp'
        list icmp_type 'echo-request'
        option src 'lan'
        option target 'ACCEPT'

config rule
        option name 'LAN-Allow-ICMPv6'
        option family 'ipv6'
        list proto 'icmp'
        option src 'lan'
        option target 'ACCEPT'
        option limit '1000/sec'
        list icmp_type 'bad-header'
        list icmp_type 'destination-unreachable'
        list icmp_type 'echo-reply'
        list icmp_type 'echo-request'
        list icmp_type 'fragmentation-needed'
        list icmp_type 'neighbour-advertisement'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'packet-too-big'
        list icmp_type 'router-advertisement'
        list icmp_type 'router-solicitation'
        list icmp_type 'time-exceeded'
        list icmp_type 'unknown-header-type'

config zone
        option name 'entlan'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'entlan'
        option input 'REJECT'

config forwarding
        option src 'entlan'
        option dest 'wan'

config rule
        option name 'LAN-MGMT-Forward-Ping'
        option family 'ipv4'
        list proto 'icmp'
        list icmp_type 'echo-request'
        option src 'lan'
        option dest 'mgmt'
        list dest_ip '192.168.100.1'
        option target 'ACCEPT'

config rule
        option name 'LAN-MGMT-Forward-HTTP'
        option family 'ipv4'
        list proto 'tcp'
        option src 'lan'
        option dest 'mgmt'
        list dest_ip '192.168.100.1'
        option dest_port '80'
        option target 'ACCEPT'

config include
        option type 'nftables'
        option fw4_compatible '1'
        option path '/etc/logging.nft'
        option position 'chain-pre'
        option chain 'accept_to_wan'

config zone
        option name 'mgmt'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'mgmt'
        option masq '1'

nft list ruleset:

table inet fw4 {
        chain input {
                type filter hook input priority filter; policy drop;
                iifname "lo" accept comment "!fw4: Accept traffic from loopback"
                ct state established,related accept comment "!fw4: Allow inbound established and related flows"
                ct state invalid drop comment "!fw4: Drop flows with invalid conntrack state"
                tcp flags syn / fin,syn,rst,ack jump syn_flood comment "!fw4: Rate limit TCP syn packets"
                iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
                iifname { "usb0", "pppoe-wan" } jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
                iifname "lan4" jump input_seclan comment "!fw4: Handle seclan IPv4/IPv6 input traffic"
                iifname "br-guestwlan" jump input_guestwlan comment "!fw4: Handle guestwlan IPv4/IPv6 input traffic"
                iifname "lan3" jump input_voiplan comment "!fw4: Handle voiplan IPv4/IPv6 input traffic"
                iifname "lan2" jump input_entlan comment "!fw4: Handle entlan IPv4/IPv6 input traffic"
                iifname "wan" jump input_mgmt comment "!fw4: Handle mgmt IPv4/IPv6 input traffic"
                jump handle_reject
        }

        chain forward {
                type filter hook forward priority filter; policy drop;
                ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
                ct state invalid drop comment "!fw4: Drop flows with invalid conntrack state"
                iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
                iifname { "usb0", "pppoe-wan" } jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
                iifname "lan4" jump forward_seclan comment "!fw4: Handle seclan IPv4/IPv6 forward traffic"
                iifname "br-guestwlan" jump forward_guestwlan comment "!fw4: Handle guestwlan IPv4/IPv6 forward traffic"
                iifname "lan3" jump forward_voiplan comment "!fw4: Handle voiplan IPv4/IPv6 forward traffic"
                iifname "lan2" jump forward_entlan comment "!fw4: Handle entlan IPv4/IPv6 forward traffic"
                iifname "wan" jump forward_mgmt comment "!fw4: Handle mgmt IPv4/IPv6 forward traffic"
                jump upnp_forward comment "Hook into miniupnpd forwarding chain"
                jump handle_reject
        }

        chain output {
                type filter hook output priority filter; policy accept;
                oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
                ct state established,related accept comment "!fw4: Allow outbound established and related flows"
                ct state invalid drop comment "!fw4: Drop flows with invalid conntrack state"
                oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
                oifname { "usb0", "pppoe-wan" } jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
                oifname "lan4" jump output_seclan comment "!fw4: Handle seclan IPv4/IPv6 output traffic"
                oifname "br-guestwlan" jump output_guestwlan comment "!fw4: Handle guestwlan IPv4/IPv6 output traffic"
                oifname "lan3" jump output_voiplan comment "!fw4: Handle voiplan IPv4/IPv6 output traffic"
                oifname "lan2" jump output_entlan comment "!fw4: Handle entlan IPv4/IPv6 output traffic"
                oifname "wan" jump output_mgmt comment "!fw4: Handle mgmt IPv4/IPv6 output traffic"
        }

        chain prerouting {
                type filter hook prerouting priority filter; policy accept;
                iifname "br-lan" jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment"
                iifname "lan4" jump helper_seclan comment "!fw4: Handle seclan IPv4/IPv6 helper assignment"
                iifname "br-guestwlan" jump helper_guestwlan comment "!fw4: Handle guestwlan IPv4/IPv6 helper assignment"
                iifname "lan3" jump helper_voiplan comment "!fw4: Handle voiplan IPv4/IPv6 helper assignment"
                iifname "lan2" jump helper_entlan comment "!fw4: Handle entlan IPv4/IPv6 helper assignment"
        }

        chain handle_reject {
                meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
                reject comment "!fw4: Reject any other traffic"
        }

        chain syn_flood {
                limit rate 25/second burst 50 packets return comment "!fw4: Accept SYN packets below rate-limit"
                drop comment "!fw4: Drop excess packets"
        }

        chain input_lan {
                tcp dport 53 counter packets 0 bytes 0 accept comment "!fw4: LAN-Allow-DNS"
                udp dport 53 counter packets 0 bytes 0 accept comment "!fw4: LAN-Allow-DNS"
                udp dport 123 counter packets 0 bytes 0 accept comment "!fw4: LAN-Allow-NTP"
                tcp dport 80 counter packets 0 bytes 0 accept comment "!fw4: LAN-Allow-HTTP"
                tcp dport 443 counter packets 0 bytes 0 accept comment "!fw4: LAN-Allow-HTTPS"
                tcp dport 9771 counter packets 0 bytes 0 accept comment "!fw4: LAN-Allow-SSH"
                tcp dport 5000 counter packets 0 bytes 0 accept comment "!fw4: LAN-Allow-UPnP"
                udp dport 1900 counter packets 2 bytes 258 accept comment "!fw4: LAN-Allow-UPnP-IGD"
                udp dport 5351 counter packets 0 bytes 0 accept comment "!fw4: LAN-Allow-NAT-PMP"
                meta nfproto ipv4 udp sport 68 udp dport 67 counter packets 0 bytes 0 accept comment "!fw4: LAN-Allow-DHCP"
                meta nfproto ipv6 udp sport 546 udp dport 547 counter packets 0 bytes 0 accept comment "!fw4: LAN-Allow-DHCPv6"
                icmp type echo-request counter packets 0 bytes 0 accept comment "!fw4: LAN-Allow-Ping"
                icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply, nd-router-solicit, nd-router-advert } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: LAN-Allow-ICMPv6"
                icmpv6 type . icmpv6 code { packet-too-big . no-route, parameter-problem . no-route, nd-neighbor-solicit . no-route, nd-neighbor-advert . no-route, parameter-problem . admin-prohibited } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: LAN-Allow-ICMPv6"
                jump reject_from_lan
        }

        chain output_lan {
                jump accept_to_lan
        }

        chain forward_lan {
                ip daddr 192.168.100.1 icmp type echo-request counter packets 0 bytes 0 jump accept_to_mgmt comment "!fw4: LAN-MGMT-Forward-Ping"
                ip daddr 192.168.100.1 tcp dport 80 counter packets 0 bytes 0 jump accept_to_mgmt comment "!fw4: LAN-MGMT-Forward-HTTP"
                jump accept_to_wan comment "!fw4: Accept lan to wan forwarding"
                jump reject_to_lan
        }

        chain helper_lan {
        }

        chain accept_to_lan {
                oifname "br-lan" counter packets 4 bytes 1556 accept comment "!fw4: accept lan IPv4/IPv6 traffic"
        }

        chain reject_from_lan {
                iifname "br-lan" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject lan IPv4/IPv6 traffic"
        }

        chain reject_to_lan {
                oifname "br-lan" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject lan IPv4/IPv6 traffic"
        }

        chain input_wan {
                meta nfproto ipv4 udp dport 68 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCP-Renew"
                icmp type echo-request counter packets 0 bytes 0 accept comment "!fw4: Allow-Ping"
                meta nfproto ipv4 meta l4proto igmp counter packets 0 bytes 0 accept comment "!fw4: Allow-IGMP"
                meta nfproto ipv6 udp dport 546 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCPv6"
                ip6 saddr fe80::/10 icmpv6 type . icmpv6 code { mld-listener-query . no-route, mld-listener-report . no-route, mld-listener-done . no-route, mld2-listener-report . no-route } counter packets 0 bytes 0 accept comment "!fw4: Allow-MLD"
                icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply, nd-router-solicit, nd-router-advert } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Input"
                icmpv6 type . icmpv6 code { packet-too-big . no-route, parameter-problem . no-route, nd-neighbor-solicit . no-route, nd-neighbor-advert . no-route, parameter-problem . admin-prohibited } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Input"
                jump reject_from_wan
        }

        chain output_wan {
                jump accept_to_wan
        }

        chain forward_wan {
                icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
                icmpv6 type . icmpv6 code { packet-too-big . no-route, parameter-problem . no-route, parameter-problem . admin-prohibited } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
                jump reject_to_wan
        }

        chain accept_to_wan {
                meta nfproto ipv4 oifname { "usb0", "pppoe-wan" } ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage"
                oifname { "usb0", "pppoe-wan" } counter packets 3 bytes 232 accept comment "!fw4: accept wan IPv4/IPv6 traffic"
        }

        chain reject_from_wan {
                iifname { "usb0", "pppoe-wan" } counter packets 5 bytes 220 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
        }

        chain reject_to_wan {
                oifname { "usb0", "pppoe-wan" } counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
        }

[... chains *_seclan, *_voiplan, *_entlan, *_guestwlan ... ]

        chain input_mgmt {
                jump reject_from_mgmt
        }

        chain output_mgmt {
                jump accept_to_mgmt
        }

        chain forward_mgmt {
                jump reject_to_mgmt
        }

        chain accept_to_mgmt {
                meta nfproto ipv4 oifname "wan" ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage"
                oifname "wan" counter packets 0 bytes 0 accept comment "!fw4: accept mgmt IPv4/IPv6 traffic"
        }

        chain reject_from_mgmt {
                iifname "wan" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject mgmt IPv4/IPv6 traffic"
        }

        chain reject_to_mgmt {
                oifname "wan" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject mgmt IPv4/IPv6 traffic"
        }

        chain dstnat {
                type nat hook prerouting priority dstnat; policy accept;
                jump upnp_prerouting comment "Hook into miniupnpd prerouting chain"
        }

        chain srcnat {
                type nat hook postrouting priority srcnat; policy accept;
                oifname { "usb0", "pppoe-wan" } jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
                oifname "wan" jump srcnat_mgmt comment "!fw4: Handle mgmt IPv4/IPv6 srcnat traffic"
                jump upnp_postrouting comment "Hook into miniupnpd postrouting chain"
        }

        chain dstnat_wan {
        }

        chain srcnat_wan {
                meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic"
        }

        chain dstnat_seclan {
        }

        chain srcnat_seclan {
        }

        chain srcnat_mgmt {
                meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 mgmt traffic"
        }

        chain raw_prerouting {
                type filter hook prerouting priority raw; policy accept;
        }

        chain raw_output {
                type filter hook output priority raw; policy accept;
        }

        chain mangle_prerouting {
                type filter hook prerouting priority mangle; policy accept;
        }

        chain mangle_postrouting {
                type filter hook postrouting priority mangle; policy accept;
        }

        chain mangle_input {
                type filter hook input priority mangle; policy accept;
        }

        chain mangle_output {
                type route hook output priority mangle; policy accept;
        }

        chain mangle_forward {
                type filter hook forward priority mangle; policy accept;
                iifname { "usb0", "pppoe-wan" } tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 ingress MTU fixing"
                oifname { "usb0", "pppoe-wan" } tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 egress MTU fixing"
        }

        chain upnp_forward {
        }

        chain upnp_prerouting {
        }

        chain upnp_postrouting {
        }
}
4

Another post because I couldn't fit everything in the 32k character limit.
fw4 print:

Section @rule[7] (Allow-IPSec-ESP) is disabled, ignoring section
Section @rule[8] (Allow-ISAKMP) is disabled, ignoring section
Automatically including '/usr/share/nftables.d/table-post/20-miniupnpd.nft'
Automatically including '/usr/share/nftables.d/chain-post/dstnat/20-miniupnpd.nft'
Automatically including '/usr/share/nftables.d/chain-post/forward/20-miniupnpd.nft'
Automatically including '/usr/share/nftables.d/chain-post/srcnat/20-miniupnpd.nft'
table inet fw4
flush table inet fw4

table inet fw4 {
        #
        # Defines
        #

        define lan_devices = { "br-lan" }
        define lan_subnets = { 192.168.1.0/24, 2XXX:XXXX:XXXX:XX00::/64, fdXX:XXXX:XXXX::/64 }

        define wan_devices = { "pppoe-wan", "usb0" }
        define wan_subnets = { XX.XX.XX.XX, fe80::XXXX:XXXX:XXXX:XXXX, 2XXX:XXXX:XXXX:XXXX::/64 }

        define seclan_devices = { "lan4" }
        define seclan_subnets = { 192.168.2.0/24, 2XXX:XXXX:XXXX:XX02::/64, fdXX:XXXX:XXXX:2::/64 }

        define guestwlan_devices = { "br-guestwlan" }
        define guestwlan_subnets = { 192.168.179.0/24, 2XXX:XXXX:XXXX:XX01::/64, fdXX:XXXX:XXXX:1::/64 }

        define voiplan_devices = { "lan3" }
        define voiplan_subnets = { 192.168.4.0/24 }

        define entlan_devices = { "lan2" }
        define entlan_subnets = { 192.168.178.0/24, 2XXX:XXXX:XXXX:XX03::/64, fdXX:XXXX:XXXX:3::/64 }

        define mgmt_devices = { "wan" }
        define mgmt_subnets = { 192.168.100.0/24 }


        #
        # User includes
        #

        include "/etc/nftables.d/*.nft"


        #
        # Filter rules
        #

        chain input {
                type filter hook input priority filter; policy drop;

                iifname "lo" accept comment "!fw4: Accept traffic from loopback"

                ct state established,related accept comment "!fw4: Allow inbound established and related flows"
                ct state invalid drop comment "!fw4: Drop flows with invalid conntrack state"
                tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "!fw4: Rate limit TCP syn packets"
                iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
                iifname { "pppoe-wan", "usb0" } jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
                iifname "lan4" jump input_seclan comment "!fw4: Handle seclan IPv4/IPv6 input traffic"
                iifname "br-guestwlan" jump input_guestwlan comment "!fw4: Handle guestwlan IPv4/IPv6 input traffic"
                iifname "lan3" jump input_voiplan comment "!fw4: Handle voiplan IPv4/IPv6 input traffic"
                iifname "lan2" jump input_entlan comment "!fw4: Handle entlan IPv4/IPv6 input traffic"
                iifname "wan" jump input_mgmt comment "!fw4: Handle mgmt IPv4/IPv6 input traffic"
                jump handle_reject
        }

        chain forward {
                type filter hook forward priority filter; policy drop;

                ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
                ct state invalid drop comment "!fw4: Drop flows with invalid conntrack state"
                iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
                iifname { "pppoe-wan", "usb0" } jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
                iifname "lan4" jump forward_seclan comment "!fw4: Handle seclan IPv4/IPv6 forward traffic"
                iifname "br-guestwlan" jump forward_guestwlan comment "!fw4: Handle guestwlan IPv4/IPv6 forward traffic"
                iifname "lan3" jump forward_voiplan comment "!fw4: Handle voiplan IPv4/IPv6 forward traffic"
                iifname "lan2" jump forward_entlan comment "!fw4: Handle entlan IPv4/IPv6 forward traffic"
                iifname "wan" jump forward_mgmt comment "!fw4: Handle mgmt IPv4/IPv6 forward traffic"
                include "/usr/share/nftables.d/chain-post/forward/20-miniupnpd.nft"
                jump handle_reject
        }

        chain output {
                type filter hook output priority filter; policy accept;

                oifname "lo" accept comment "!fw4: Accept traffic towards loopback"

                ct state established,related accept comment "!fw4: Allow outbound established and related flows"
                ct state invalid drop comment "!fw4: Drop flows with invalid conntrack state"
                oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
                oifname { "pppoe-wan", "usb0" } jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
                oifname "lan4" jump output_seclan comment "!fw4: Handle seclan IPv4/IPv6 output traffic"
                oifname "br-guestwlan" jump output_guestwlan comment "!fw4: Handle guestwlan IPv4/IPv6 output traffic"
                oifname "lan3" jump output_voiplan comment "!fw4: Handle voiplan IPv4/IPv6 output traffic"
                oifname "lan2" jump output_entlan comment "!fw4: Handle entlan IPv4/IPv6 output traffic"
                oifname "wan" jump output_mgmt comment "!fw4: Handle mgmt IPv4/IPv6 output traffic"
        }

        chain prerouting {
                type filter hook prerouting priority filter; policy accept;
                iifname "br-lan" jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment"
                iifname "lan4" jump helper_seclan comment "!fw4: Handle seclan IPv4/IPv6 helper assignment"
                iifname "br-guestwlan" jump helper_guestwlan comment "!fw4: Handle guestwlan IPv4/IPv6 helper assignment"
                iifname "lan3" jump helper_voiplan comment "!fw4: Handle voiplan IPv4/IPv6 helper assignment"
                iifname "lan2" jump helper_entlan comment "!fw4: Handle entlan IPv4/IPv6 helper assignment"
        }

        chain handle_reject {
                meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
                reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
        }

        chain syn_flood {
                limit rate 25/second burst 50 packets return comment "!fw4: Accept SYN packets below rate-limit"
                drop comment "!fw4: Drop excess packets"
        }

        chain input_lan {
                tcp dport 53 counter accept comment "!fw4: LAN-Allow-DNS"
                udp dport 53 counter accept comment "!fw4: LAN-Allow-DNS"
                udp dport 123 counter accept comment "!fw4: LAN-Allow-NTP"
                tcp dport 80 counter accept comment "!fw4: LAN-Allow-HTTP"
                tcp dport 443 counter accept comment "!fw4: LAN-Allow-HTTPS"
                tcp dport 9771 counter accept comment "!fw4: LAN-Allow-SSH"
                tcp dport 5000 counter accept comment "!fw4: LAN-Allow-UPnP"
                udp dport 1900 counter accept comment "!fw4: LAN-Allow-UPnP-IGD"
                udp dport 5351 counter accept comment "!fw4: LAN-Allow-NAT-PMP"
                meta nfproto ipv4 udp sport 68 udp dport 67 counter accept comment "!fw4: LAN-Allow-DHCP"
                meta nfproto ipv6 udp sport 546 udp dport 547 counter accept comment "!fw4: LAN-Allow-DHCPv6"
                meta nfproto ipv4 icmp type 8 counter accept comment "!fw4: LAN-Allow-Ping"
                meta nfproto ipv6 icmpv6 type { 1, 129, 128, 134, 133, 3 } limit rate 1000/second counter accept comment "!fw4: LAN-Allow-ICMPv6"
                meta nfproto ipv6 icmpv6 type . icmpv6 code { 4 . 0, 136 . 0, 135 . 0, 2 . 0, 4 . 1 } limit rate 1000/second counter accept comment "!fw4: LAN-Allow-ICMPv6"
                jump reject_from_lan
        }

        chain output_lan {
                jump accept_to_lan
        }

        chain forward_lan {
                ip daddr 192.168.100.1 icmp type 8 counter jump accept_to_mgmt comment "!fw4: LAN-MGMT-Forward-Ping"
                ip daddr 192.168.100.1 tcp dport 80 counter jump accept_to_mgmt comment "!fw4: LAN-MGMT-Forward-HTTP"
                jump accept_to_wan comment "!fw4: Accept lan to wan forwarding"
                jump reject_to_lan
        }

        chain helper_lan {
        }

        chain accept_to_lan {
                oifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic"
        }

        chain reject_from_lan {
                iifname "br-lan" counter jump handle_reject comment "!fw4: reject lan IPv4/IPv6 traffic"
        }

        chain reject_to_lan {
                oifname "br-lan" counter jump handle_reject comment "!fw4: reject lan IPv4/IPv6 traffic"
        }

        chain input_wan {
                meta nfproto ipv4 udp dport 68 counter accept comment "!fw4: Allow-DHCP-Renew"
                meta nfproto ipv4 icmp type 8 counter accept comment "!fw4: Allow-Ping"
                meta nfproto ipv4 meta l4proto igmp counter accept comment "!fw4: Allow-IGMP"
                meta nfproto ipv6 udp dport 546 counter accept comment "!fw4: Allow-DHCPv6"
                ip6 saddr fe80::/10 icmpv6 type . icmpv6 code { 130 . 0, 131 . 0, 132 . 0, 143 . 0 } counter accept comment "!fw4: Allow-MLD"
                meta nfproto ipv6 icmpv6 type { 128, 129, 1, 3, 133, 134 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Input"
                meta nfproto ipv6 icmpv6 type . icmpv6 code { 2 . 0, 4 . 0, 4 . 1, 135 . 0, 136 . 0 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Input"
                jump reject_from_wan
        }

        chain output_wan {
                jump accept_to_wan
        }

        chain forward_wan {
                meta nfproto ipv6 icmpv6 type { 128, 129, 1, 3 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Forward"
                meta nfproto ipv6 icmpv6 type . icmpv6 code { 2 . 0, 4 . 0, 4 . 1 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Forward"
                jump reject_to_wan
        }

        chain accept_to_wan {
                meta nfproto ipv4 oifname { "pppoe-wan", "usb0" } ct state invalid counter drop comment "!fw4: Prevent NAT leakage"
                oifname { "pppoe-wan", "usb0" } counter accept comment "!fw4: accept wan IPv4/IPv6 traffic"
        }

        chain reject_from_wan {
                iifname { "pppoe-wan", "usb0" } counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
        }

        chain reject_to_wan {
                oifname { "pppoe-wan", "usb0" } counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
        }

[... chains *_seclan, *_voiplan, *_entlan, *_guestwlan ... ]

        chain input_mgmt {
                jump reject_from_mgmt
        }

        chain output_mgmt {
                jump accept_to_mgmt
        }

        chain forward_mgmt {
                jump reject_to_mgmt
        }

        chain accept_to_mgmt {
                meta nfproto ipv4 oifname "wan" ct state invalid counter drop comment "!fw4: Prevent NAT leakage"
                oifname "wan" counter accept comment "!fw4: accept mgmt IPv4/IPv6 traffic"
        }

        chain reject_from_mgmt {
                iifname "wan" counter jump handle_reject comment "!fw4: reject mgmt IPv4/IPv6 traffic"
        }

        chain reject_to_mgmt {
                oifname "wan" counter jump handle_reject comment "!fw4: reject mgmt IPv4/IPv6 traffic"
        }


        #
        # NAT rules
        #

        chain dstnat {
                type nat hook prerouting priority dstnat; policy accept;
                include "/usr/share/nftables.d/chain-post/dstnat/20-miniupnpd.nft"
        }

        chain srcnat {
                type nat hook postrouting priority srcnat; policy accept;
                oifname { "pppoe-wan", "usb0" } jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
                oifname "wan" jump srcnat_mgmt comment "!fw4: Handle mgmt IPv4/IPv6 srcnat traffic"
                include "/usr/share/nftables.d/chain-post/srcnat/20-miniupnpd.nft"
        }

        chain srcnat_wan {
                meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic"
        }

        chain srcnat_mgmt {
                meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 mgmt traffic"
        }


        #
        # Raw rules (notrack)
        #

        chain raw_prerouting {
                type filter hook prerouting priority raw; policy accept;
        }

        chain raw_output {
                type filter hook output priority raw; policy accept;
        }


        #
        # Mangle rules
        #

        chain mangle_prerouting {
                type filter hook prerouting priority mangle; policy accept;
        }

        chain mangle_postrouting {
                type filter hook postrouting priority mangle; policy accept;
        }

        chain mangle_input {
                type filter hook input priority mangle; policy accept;
        }

        chain mangle_output {
                type route hook output priority mangle; policy accept;
        }

        chain mangle_forward {
                type filter hook forward priority mangle; policy accept;
                iifname { "pppoe-wan", "usb0" } tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 ingress MTU fixing"
                oifname { "pppoe-wan", "usb0" } tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 egress MTU fixing"
        }

        include "/usr/share/nftables.d/table-post/20-miniupnpd.nft"
}
5

You need to enclose your 4 rules in
chain accept_to_wan {
...
}
and place ad /etc/nftables.d/whatever.nft

1 Like
6

Yes, that works, thanks. But why doesn't it work using the include config as described in the wiki?

7

I dont know, chain-prepend equivalent kinda works in sysupgrade friendly way using those. Rule has to add include as first in chain

 chain xxx { 
     counter log comment "ur rule"
     ....
  }

I feel you need dns interception instead:

config redirect 'dns_int'
        option name 'Intercept-DNS'
        option src 'lan'
        option src_dport '53'
        option proto 'tcp udp'
        option family 'any'
        option target 'DNAT'

Or your rules optimize to (ignoring branching messages):

meta l4proto {tcp,udp} th dport {53,853} counter log prefix "mew"
8

accept_to_wan and other “verdict to/from zone” chains don’t accommodate includes (no chain-prepend statement below).

5 Likes
9

For sake of completeness you can prepend includes in /etc/nftables.d also for hook rules repeating hook prefix.

10

I see, nice find.

I wanted to log all DNS connections going to WAN (both from clients and the router itself) and I figured this would be the most appropriate chain. Is there anything wrong with using the verdict chains for this or are the missing include statements unintentional?

For configuration management it would be nicer for the included file to be generic and configure the chain via uci but in any case @brada4's solution works fine.

11

jow did that mimicking fw3 workings?...

12

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.