Several people have asked about updating the SimpleHFSCGamerScript stuff from
the main issue is the script uses iptables scripts in dscptag.sh which need to be translated to nftables and we need to figure out how to hook that into fw4.
What I need to know is where do we put the nft scripts so the firewall will pick them up? And then I need some volunteers to test, because I don't have any OpenWrt devices to test with!
@Lynx has been fiddling with nftables stuff recently, maybe he can suggest how to hook into the fw4. Then please say hi anyone who is interested in testing!
Hello Daniel,
From what I could see by viewing scripts on the forum based on nftables seems to reside in the root folder, ./xxxx.sh will set up the rules in fw4. if others can confirm this?
Ok, I've pushed a new file dscptag.nft into the devel branch of my repository linked above. I haven't checked it for syntax errors or anything... so if someone could test it out, make some effort to figure out if there are some obvious typos or bugs... etc and report back It'd help.
I think to install it you need to put the file in /etc/nftables.d/ then reload the firewall... you'll likely get errors, almost 100% guaranteed at this point.
When the next 22.03 rc or final is released, or latest snapshot, firewall4 will recognize includes under /usr/share/nftables.d/ with a location subdirectory. Since you want to add a new table, you would place the include in /usr/share/nftables.d/ruleset-post/ so it comes after the default table inet fw4.
If you want to test right now with 22.03-rc6, you have to specify an include in /etc/config/firewall:
config include
option type nftables
option path /etc/dscptag.nft
option position ruleset-append
and does it handle entire table includes, or just individual chains in existing table? because I'm writing this like it's just a separate table entirely...
Im using the latest snapshot and placing file in /usr/share/nftables.d/ nftables does not recognize automatically, so I used the latest advice and moved file to /etc and with include string in firewall
the output is:
Summary
root@OpenWrt:/usr/share/nftables.d# service firewall restart
Section @include[0] is not marked as compatible with fw4, ignoring section
Section @include[0] requires 'option fw4_compatible 1' to be considered compatible
root@OpenWrt:/usr/share/nftables.d# service firewall restart
Section @include[0] is not marked as compatible with fw4, ignoring section
Section @include[0] requires 'option fw4_compatible 1' to be considered compatible
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:2:1-11: Error: syntax error, unexpected string
udpbulkport = {51413}
^^^^^^^^^^^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:3:1-11: Error: syntax error, unexpected string
tcpbulkport = {51413,6881-6889}
^^^^^^^^^^^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:4:1-12: Error: syntax error, unexpected string
vidconfports = {10000,3478:3479,8801:8802,19302:19309,5938,53}
^^^^^^^^^^^^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:5:1-9: Error: syntax error, unexpected string
realtime4 = {192.168.1.55} # example, just add all your game console here
^^^^^^^^^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:6:1-9: Error: syntax error, unexpected string
realtime6 = {fd90::129a} ## example only replace with game console
^^^^^^^^^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:7:1-11: Error: syntax error, unexpected string
lowpriolan4 = {192.168.1.100} # example, add your low priority lan machines here
^^^^^^^^^^^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:8:1-11: Error: syntax error, unexpected string
lowpriolan6 = {fd90::129a} ## example, add your low priority lan ipv6 PUBLIC addr here
^^^^^^^^^^^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:10:1-7: Error: syntax error, unexpected string
ackrate = 300
^^^^^^^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:12:1-8: Error: syntax error, unexpected string
downrate = 850000 # kbits/sec ... CHANGE ME
^^^^^^^^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:13:1-6: Error: syntax error, unexpected string
uprate = 855000 # kbits/sec ... CHANGE ME
^^^^^^
unfortunately for me its not clear where is the typo..
# "table-pre" would be included here
table inet fw4 {
# "ruleset-pre" would be included here
chain input {
type filter hook input priority filter; policy accept;
# "chain-pre/input" would be included here
iifname "lo" accept comment "!fw4: Accept traffic from loopback"
...other fw4 rules...
# "chain-post/input" would be included here
}
...other fw4 chains...
chain mangle_forward {
type filter hook forward priority mangle; policy accept;
# "chain-pre/mangle_forward" would be included here
...fw4 rules...
# "chain-post/mangle_forward" would be included here
}
# "ruleset-post" would be included here
}
# "table-post" would be included here
Thanks @dave14305 removed old firewall.user and the message gone, but, the syntax errors still there after adding define option for variables:
root@OpenWrt:/usr/share/nftables.d# service firewall restart
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:15:8-12: Error: syntax error, unexpected table, expecting string
define table inet dscptag {
^^^^^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:21:12-13: Error: syntax error, unexpected ip
ip ip dscp set cs0
^^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:22:13-15: Error: syntax error, unexpected ip6
ip6 ip6 dscp set cs0
^^^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:24:12-16: Error: syntax error, unexpected string
ip proto udp udp sport = $udpbulkport ip dscp set cs1
^^^^^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:25:35-35: Error: syntax error, unexpected '='
ip6 nexthdr udp udp sport = $udpbulkport ip6 dscp set cs1
^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:27:12-16: Error: syntax error, unexpected string
ip proto udp udp dport = $udpbulkport ip dscp set cs1
^^^^^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:28:35-35: Error: syntax error, unexpected '='
ip6 nexthdr udp udp dport = $udpbulkport ip6 dscp set cs1
^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:30:12-16: Error: syntax error, unexpected string
ip proto tcp tcp sport = $tcpbulkport ip dscp set cs1
^^^^^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:31:35-35: Error: syntax error, unexpected '='
ip6 nexthdr tcp tcp sport = $tcpbulkport ip6 dscp set cs1
^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:32:12-16: Error: syntax error, unexpected string
ip proto tcp tcp dport = $tcpbulkport ip dscp set cs1
root@OpenWrt:~# service firewall restart
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:14:1-5: Error: syntax error, unexpected table
table inet dscptag {
^^^^^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:20:12-13: Error: syntax error, unexpected ip
ip ip dscp set cs0
^^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:21:13-15: Error: syntax error, unexpected ip6
ip6 ip6 dscp set cs0
^^^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:23:12-16: Error: syntax error, unexpected string
ip proto udp udp sport = $udpbulkport ip dscp set cs1
^^^^^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:24:35-35: Error: syntax error, unexpected '='
ip6 nexthdr udp udp sport = $udpbulkport ip6 dscp set cs1
^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:26:12-16: Error: syntax error, unexpected string
ip proto udp udp dport = $udpbulkport ip dscp set cs1
^^^^^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:27:35-35: Error: syntax error, unexpected '='
ip6 nexthdr udp udp dport = $udpbulkport ip6 dscp set cs1
^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:29:12-16: Error: syntax error, unexpected string
ip proto tcp tcp sport = $tcpbulkport ip dscp set cs1
^^^^^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:30:35-35: Error: syntax error, unexpected '='
ip6 nexthdr tcp tcp sport = $tcpbulkport ip6 dscp set cs1
^
In file included from /dev/stdin:218:2-28:
/etc/dscptag.nft:31:12-16: Error: syntax error, unexpected string
ip proto tcp tcp dport = $tcpbulkport ip dscp set cs1