Migrate to OpenWrt 25.12.2 iptables to nftables

Installing and Using OpenWrt Network and Wireless Configuration
1

Legacy rules detected

There are legacy iptables rules present on the system. Mixing iptables and nftables rules is discouraged and may lead to incomplete traffic filtering.

How to migrate from IPtables to nftabes for normale endusers?

System:

{
	"kernel": "6.12.74",
	"hostname": "GL-MT6000_Direktanschluss_GF",
	"system": "ARMv8 Processor rev 4",
	"model": "GL.iNet GL-MT6000",
	"board_name": "glinet,gl-mt6000",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "25.12.2",
		"firmware_url": "https://downloads.openwrt.org/",
		"revision": "r32802-f505120278",
		"target": "mediatek/filogic",
		"description": "OpenWrt 25.12.2 r32802-f505120278",
		"builddate": "1774469393"
	}
}

Firewall:

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'
	list network 'WGSERVER'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'WAN2_5G'
	list network 'Glasfaser'
	list network 'Glasfasermodem'
	list network 'WAN_GF'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option src 'lan'
	option src_dport '53'
	option name 'AdGuardHome DNS Interception'
	option src_ip '!192.168.152.1'
	option dest_ip '192.168.152.1'
	option dest_port '53'

config nat
	option name 'Prevent hardcoded DNS'
	list proto 'tcp'
	list proto 'udp'
	option src 'lan'
	option dest_ip '192.168.152.1'
	option dest_port '53'
	option target 'MASQUERADE'

config rule
	option name 'VPN'
	list proto 'udp'
	option src 'wan'
	option dest_port '47362'
	option target 'ACCEPT'

config zone
	option name 'gast'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'Gaston'

config forwarding
	option src 'gast'
	option dest 'wan'

config rule
	option src 'gast'
	option name 'Erlaube DNS Anfragen aus Gast'
	option dest_port '53'
	option target 'ACCEPT'

config rule
	option src 'gast'
	option name 'Erlaube DHCP Anfragen aus Gast'
	list proto 'udp'
	option dest_port '67-68'
	option target 'ACCEPT'

config rule
	option src 'gast'
	option dest 'lan'
	option name 'Block Gast zu Lan'
	list dest_ip '192.168.152.0/24'
	option target 'REJECT'
	list proto 'all'

mwan3 - because the report list only mwan3 issues when I understand the error message…

config globals 'globals'
	option mmx_mask '0x3F00'

config interface 'WAN2_5G'
	option enabled '1'
	list track_ip '1.0.0.1'
	list track_ip '1.1.1.1'
	list track_ip '208.67.222.222'
	list track_ip '208.67.220.220'
	option family 'ipv4'
	option reliability '1'
	option initial_state 'online'
	option track_method 'ping'
	option count '1'
	option size '56'
	option max_ttl '60'
	option timeout '3'
	option interval '5'
	option failure_interval '5'
	option recovery_interval '5'
	option down '5'
	option up '5'

config member 'wan_m1_w5'
	option interface 'WAN_GF'
	option metric '1'
	option weight '9'

config member 'wan_m2_w3'
	option interface 'WAN_GF'
	option metric '2'
	option weight '3'

config member 'WAN2_5G_m1_w2'
	option interface 'WAN2_5G'
	option metric '1'
	option weight '2'

config member 'WAN2_5G_m1_w1'
	option interface 'WAN2_5G'
	option metric '1'
	option weight '1'

config member 'WAN2_5G_m2_w2'
	option interface 'WAN2_5G'
	option metric '2'
	option weight '2'

config policy 'wan_only'
	list use_member 'wan_m1_w5'
	option last_resort 'unreachable'

config policy 'WAN2_5G_only'
	list use_member 'WAN2_5G_m1_w2'
	option last_resort 'unreachable'

config policy 'balanced'
	list use_member 'wan_m1_w5'
	list use_member 'WAN2_5G_m1_w1'
	option last_resort 'unreachable'

config policy 'wan_WAN2_5G'
	list use_member 'wan_m1_w5'
	list use_member 'WAN2_5G_m2_w2'
	option last_resort 'unreachable'

config policy 'WAN2_5G_wan'
	list use_member 'wan_m2_w3'
	list use_member 'WAN2_5G_m1_w2'
	option last_resort 'unreachable'

config rule 'https'
	option sticky '1'
	option dest_port '443'
	option proto 'tcp'
	option use_policy 'balanced'

config rule 'default_rule_v4'
	option dest_ip '0.0.0.0/0'
	option use_policy 'balanced'
	option family 'ipv4'

config rule 'default_rule_v6'
	option dest_ip '::/0'
	option use_policy 'balanced'
	option family 'ipv6'

config interface 'WAN_GF'
	option enabled '1'
	option initial_state 'online'
	option family 'ipv4'
	list track_ip '1.0.0.1'
	list track_ip '1.1.1.1'
	list track_ip '208.67.222.222'
	list track_ip '208.67.220.220'
	option track_method 'ping'
	option reliability '1'
	option count '1'
	option size '56'
	option max_ttl '60'
	option timeout '2'
	option interval '5'
	option failure_interval '5'
	option recovery_interval '5'
	option down '5'
	option up '5'
2

The port of mwan3 to use nftables is actually an ongoing actiity. You should wait, until completed. Watch Mwan3 port to nftables - #157 by dl12345

3

Thanks for quick responding.