Iptables equivalent in OpenWrt

[macchiato]

How does this translate into OpenWrt?

Since paqet uses pcap to bypass standard firewalls, you MUST configure
iptables on the server to prevent kernel interference:

sudo iptables -t raw -A PREROUTING -p tcp --dport 9999 -j NOTRACK
sudo iptables -t raw -A OUTPUT -p tcp --sport 9999 -j NOTRACK
sudo iptables -t mangle -A OUTPUT -p tcp --sport 9999 --tcp-flags RST RST -j DROP
Replace 9999 with your actual listen port.

[anon63541380]

@macchiato

Replace 9999 with your actual listen port.

Are you copying AI questions? You know that RAW tables do not have distinction between local sockets and routing, so you will un-NAT all port traffic?

What is your end goal? I'd guess just tap "drop inValid packets" in firewall and you are safe from middlebox resets....

[macchiato]

@anon63541380

Are you copying AI questions?

No, just the requirements.

example/server.yaml.example

@anon63541380

What is your end goal?

more OpenWrt friendly implementation rather than a cold iptables script.

[dave14305]

You can create rules in LuCI that use the “don’t track” action (target), which equates to NOTRACK. Whether it gives you the results you want will be hard to say.

Check the results with nft list ruleset and look for the “raw” and “notrack” chains.

[anon63541380]

The setjp is not ok on a router... iptables-translate helps

[anon63541380]

@macchiato

# sudo iptables -t raw -A PREROUTING -p tcp --dport 9999 -j NOTRACK
          # sudo iptables -t raw -A OUTPUT -p tcp --sport 9999 -j NOTRACK  
          # sudo iptables -t mangle -A OUTPUT -p tcp --sport 9999 --tcp-flags RST RST -j DROP
          

Place somefile.nft into /etc/nftables.d/

chain raw_prerouting {
  type filter hook prerouting priority raw; policy accept;
  tcp dport 9999 counter notrack
}
chain raw_output {
  type filter hook output priority raw; policy accept;
  # th sport 9999 tcp flags rst counter drop
  # tcp sport 9999 counter notrack
  tcp sport 9999 counter notrack tcp flags rst counter drop
}

EDIT - save one payload reference....