Firewall4 (fw4) port forwards + Luci + IPv6

timur.davletshin · March 16, 2023, 4:23pm

Luci interface (OpenWrt 22.03.03) is having troubles understanding option family ipv6 option in /etc/config/firewall. Regardless of family specified it will say 'IPv4'. Also interface part doesn't provide option to choose between IPv6 or IPv4 the way does in 'Traffic Rules'.

Firewall itself works fine.

AndrewZ · March 16, 2023, 5:58pm

Are you sure you need Port Forwards for IPv6? What's the use case?

timur.davletshin · March 16, 2023, 6:04pm

Yes, I'm sure, that CLI and Luci are expected to give the same result. Especially if the case is desrcibed in IPv6 firewall examples.

timur.davletshin · March 16, 2023, 6:07pm

Adblock support thread - #2389 by timur.davletshin - this is one of use cases.

efahl · March 16, 2023, 6:51pm

Does this fix it?

timur.davletshin · March 16, 2023, 7:17pm

I have no idea how to test it but I don't like if family is any/empty , assume it is ipv4 statement. It is different from Traffic Rules logic where no family specified means both IPv4 and IPv6. Also it changes behavior for those migrating from previous versions of OpenWrt. Logic in all tabs should be the same.

jow · March 17, 2023, 8:22am

This is based on the logic of firewall4 itself:

github.com

openwrt/firewall4/blob/master/root/usr/share/ucode/fw4.uc#L2974..L2976


      
          				this.warn_section(data, "specifies multiple rewrite addresses, using only first one");
          
          			let has_ip4_addr = length(sip[0]) || length(dip[0]) || length(rip[0]),
          			    has_ip6_addr = length(sip[1]) || length(dip[1]) || length(rip[1]),
          			    has_any_addr = has_ip4_addr || has_ip6_addr;
          
          			/* check if there's no AF specific bits, in this case we can do an AF agnostic rule */
          			if (!family && !has_any_addr) {
          				/* for backwards compatibility, treat unspecified family as IPv4 unless user explicitly requested any (0) */
          				if (family == null)
          					family = 4;
          
          				add_rule(family, proto, [], [], null, sport, dport, rport, null, redir);
          			}
          
          			/* we need to emit one or two AF specific rules */
          			else {
          				if ((!family || family == 4) && (!has_any_addr || has_ip4_addr)) {
          					for (let saddrs in subnets_group_by_masking(sip[0]))
          						for (let daddrs in subnets_group_by_masking(dip[0]))
          							add_rule(4, proto, saddrs, daddrs, rip[0], sport, dport, rport, ipset, redir);

This was done to retain backwards compatibility. Suddenly forwarding/exposing IPv6 ports when upgrading to fw4 where they've historically always been IPv4 only with the same configuration could have undesired security implications.

Therefor a user has to explicitly set family: any or family: ipv6 to make an IPv6 capable port forward. Without specifying any family, it will default to IPv4 to mimic the long standing default behavior.

timur.davletshin · March 17, 2023, 12:41pm

Thank you for the explanation, now it is clear