Fresh install of OpenWRT - Firewall errrors / warnings

Installing and Using OpenWrt
41

IDK if this will be any help, it's a list of the backup settings for the working firmware:

Backup file list
Below is the determined list of files to backup. It consists of changed configuration files marked by opkg, essential base files and the user defined backup patterns.

/etc/config/ddns
/etc/config/dhcp
/etc/config/dropbear
/etc/config/firewall
/etc/config/luci
/etc/config/network
/etc/config/ntpclient
/etc/config/openssl
/etc/config/qos
/etc/config/rpcd
/etc/config/smp_affinity
/etc/config/system
/etc/config/ubootenv
/etc/config/ucitrack
/etc/config/uhttpd
/etc/config/wireless
/etc/dropbear/dropbear_ed25519_host_key
/etc/dropbear/dropbear_rsa_host_key
/etc/fw_env.config
/etc/group
/etc/hosts
/etc/inittab
/etc/luci-uploads/.placeholder
/etc/nftables.d/10-custom-filter-chains.nft
/etc/nftables.d/README
/etc/opkg/keys/b5043e70f9a75cde
/etc/opkg/keys/ed9250ac23034fed
/etc/passwd
/etc/profile
/etc/rc.local
/etc/shadow
/etc/shells
/etc/shinit
/etc/sysctl.conf
/etc/uhttpd.crt
/etc/uhttpd.key
/etc/uhttpd.key
/etc/uhttpd.crt
42

The backup file list almost all about config files and the like. It's not going to tell you about the installed packages. Except, in this case, we can see that there is a lot of non-standard stuff installed and configured in the config directory.

43

yes, this explains the difference in size!

it's definitely custom - after factory reset, as well as cp /rom/etc/firewall /etc/firewall i'm still getting the "legacy" rules warning - so it looks like it is even in the firmware itself.

i'll let you know if i get a reply to the bug report.

1 Like
44

Check
nft list ruleset | grep xt
Then add mising nftables modules according to
https://wiki.nftables.org/wiki-nftables/index.php/Supported_features_compared_to_xtables
you cannot get rid of set string or u32 and the warrning will be flagged as soon as packet passes hudden rule set by xt nft bridge.
certainly conflicting are mark and nat modules.

best is to reboot adding nft modules to clear old engine for good.