Firewall4 / NFtables Tips and Tricks

So in my case, I had the below rule in /etc/config/firewall to forward both tcp and udp 60002 to the internal host

config redirect
        option target 'DNAT'
        option src 'wan'
        option dest 'lan'
        option proto 'tcp udp'
        option dest_ip '192.168.1.2'
        option dest_port '60002'
        option src_dport '60002'

fw4 translated it to the below, it got the tcp rule right, but the udp rule is missing a port number so all udp traffic was forwarded to the internal host. I've worked around the issue by having separate rules for tcp and udp and as a bonus, nft makes a little more sense than it did this time yesterday :slight_smile:

 meta nfproto ipv4 tcp dport 60002 counter packets 9 bytes 476 dnat ip to 192.168.1.2:60002 
 meta nfproto ipv4 meta l4proto udp counter packets 12 bytes 1538 dnat ip to 192.168.1.2 
2 Likes