Ping from the OpenWrt box to an IPv6 address breaks after adding the following last line to the nftables firewall script:
add rule inet nat POSTROUTING meta nfproto ipv4 oifname "eth0.2" counter masquerade
If I remove this last line, I get ping replies, but then I cannot reach services like ssh to internett from a computer connected to one of the interfaces.
[Andrispe]
Do you have iptables or config/firewall source of your translated nftables
script?
Some years ago I switched from iptables to nftables.
Please connect to your OpenWrt device using ssh and copy the output of the
following commands and post it here using the "Preformatted text </> " button:
grafik
Hope it's fine to reply by email. That's easiest for me, as I'm using a screen reader.
[...]
ubus call system board
{
"kernel": "5.15.162",
"hostname": "lamagw",
"system": "Atheros AR9344 rev 2",
"model": "TP-Link TL-WDR3600 v1",
"board_name": "tplink,tl-wdr3600-v1",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "23.05.4",
"revision": "r24012-d8dd03c46f",
"target": "ath79/generic",
"description": "OpenWrt 23.05.4 r24012-d8dd03c46f"
}
}
cat /etc/config/network
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fda4:f0f0:5137::/48'
config interface 'lan'
option ifname 'eth0.1 tap0'
option force_link '1'
option type 'bridge'
option proto 'static'
option ipaddr '10.0.1.1'
option netmask '255.255.255.0'
option dhcpv6 disabled # it doesn't work at the moment.
option ip6assign '60'
config interface wlan
option ifname 'eth0.3 wlan'
option type 'bridge'
option proto 'static'
option ipaddr '192.168.2.1'
option netmask '255.255.255.0'
option dhcpv6 disabled
option ip6assign '60'
config interface 'wan'
option ifname 'eth0.2'
option proto 'dhcp'
config interface 'wan6'
option ifname '@wan'
option proto 'dhcpv6'
option reqprefix 'auto'
option reqaddress 'try'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0t 2 3 4'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '0t 1'
config switch_vlan
option device 'switch0'
option vlan '3'
option ports '0t 5'
cat /etc/config/wireless
I've turned off wireless on this box at one point, but see now that the radios are enabled. Anyway, I have an external access point connected to one of the lan ports.
config wifi-device 'radio0'
option type 'mac80211'
option channel '11'
option hwmode '11g'
option htmode 'HT20'
option country 'NO'
option disabled '0'
option path 'platform/ahb/18100000.wmac'
config wifi-iface 'default_radio0'
option device 'radio0'
option network 'wlan'
option mode 'ap'
option ssid 'lamasti'
option encryption 'none'
config wifi-device 'radio1'
option type 'mac80211'
option channel '36'
option hwmode '11a'
option path 'pci0000:00/0000:00:00.0'
option htmode 'HT20'
option country 'NO'
option disabled '0'
config wifi-iface 'default_radio1'
option device 'radio1'
option network 'wlan'
option mode 'ap'
option ssid 'lamasti'
option encryption 'none'
cat /etc/config/dhcp
config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'x'
option expandhosts '1'
option nonegcache '0'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.auto'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv6 'server'
option ra 'server'
config dhcp 'wlan'
option interface 'wlan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv6 'server'
option ra 'server'
config dhcp 'wl'
option interface 'wl'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv6 'server'
option ra 'server'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
cat /etc/config/firewall
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option drop_invalid '1'
option synflood_protect '1'
option synflood_rate '25/s'
option synflood_burst '50'
option tcp_ecn '1'
option tcp_syncookies '1'
option tcp_window_scaling '1'
#config include
option type 'script'
option path '/etc/firewall.nft'
option fw4_compatible 1
config rule
option target 'ACCEPT'
option src 'wan'
option proto 'udp'
option dest_port '546'
option name 'Allow DHCPv6 replies'
option family 'ipv6'
option src_port '547'
Thanks