Hardware NAT For LEDE

it was me being a spoon, my parent path had a space ... what a dipstick... thanks all

sorry for a stupid question but what do i have to select in menuconfig ? i choose lantiq and xrx200 then bt home hub. but is there anything else ?

See comment of Mushot above.

Sorry now im confused.. are you saying to not use nbd staging and just use master? I can see from the above comments there seems to be an issue with premature connection drops

You can use the master tree if you want to

Now work well for my.


But i have some problems, apparently Flow Offload breaks SQM.

Not that I know the details, but the whole idea of Off-loading is to side step the conventional linux networking stack. So the fact that those features this stack provides are not available is not really breakage in my book...

Does this have any security implications that you know of?

You are right. I had done the test in an image with Qualcom Fast Path, right now I am using Flow Offload in a new compilation and SQM works fine. Downloading several files and at the same time doing streaming on YouTube.

Thank you.

Thanks for testing. I just pushed a change that enables offloading in the default configuration, so upcoming snapshot builds will have it included.
It still needs to be enabled manually in /etc/config/firewall though.


Does offloading work on every device or is this hw specific?
SFE hack did work on all my devices...

I had seen the last commit on nbd´s tree which enable hw nat for mt7621...
What does this mean? How can i implement this for my mt7620a device? Where can we get documantation for mt7620 hw nat?

How can i check which connections are offloaded?
With fast_classifier i could look into /sys/class/fast_classifier/debug_info...

The current version in the master branch is a software offloading solution and will work on all devices, regardless of chipset used. Flow-offload also allows for hardware specific offloading which will be even faster, but needs to be implemented for specific hardware.

@nbd and John Crispin are currently developing this for MT7621 in @nbd 's staging tree. I haven't tested it yet, so I have no idea if (and what) already works and how well. I would recommend sticking to the master branch and using the software version for now. But you are always free to try out the bleeding edge from the staging tree :slight_smile:

Great news, thanks.
The hw offloading sounds very interesting :slight_smile:

Thank you @nbd for backporting such great features.

I will do some test with iperf...

I will get almost the same speed as with sfe on my mt7620a router.

Now i´m waiting for linux 4.14 on ar71xx plattform... :slight_smile:

Offloaded connections will show [OFFLOAD] in /proc/net/nf_conntrack
The mt7621 hw offload driver in my staging tree seems work well for IPv4, we intend to push it to master soon. IPv6 is not integrated yet, but is currently being worked on.
We plan on having MT7620 support as well eventually.


This is awesome news, thank you @nbd!
I just ordered a Xiaomi MI3G, looking forward to testing HW offload.

Is IPv6 integrated in the software flow offload? You're doing an amazing work with the flow offload stuff by the way. Really exciting stuff to see being integrated into Lede! :slight_smile: Thank you very much for your hard work

Yes, software flow offload should be able to handle IPv6, but it hasn't been tested thoroughly yet

1 Like

Great news, thanks for hard work @nbd

@nbd I built an image from your staging branch to my Xiaomi MIR3G and offloading seems to work great, thank you!
I noticed one thing which is a bit bugging me. Offloaded connections don't seem to register in ifconfig's RX/TX bytes on the WAN and LAN interfaces, so Luci's traffic graphs, vnstat and collectd can't measure the amount of traffic.
Is this an expected side-effect of offloading? Can this be fixed somehow?

Has flowoffload hit the snapshot build for Archer C7 v2? Also do you just run the command

iptables -I FORWARD 1 -m conntrack --ctstate RELATED,ESTABLISHED -j FLOWOFFLOAD

in SSH and that's it?