PBR 1.1.6-20 does not work

Installing and Using OpenWrt
1

I have been using without issues pbr-1.1.1-7 and its Luci counterpart for a while on OpenWRT <= 23.05.04. Very simple ruleset sending traffic from a distinct wifi network to a wireguard link.

However, I noticed there's a new version of pbr labeled 1.1.6-20, and this version is unable to startup, as it has trouble to recognize the WG links. This problem persisted on both OpenWRT 23.05.04 and 23.05.05.

I have some older custom builds (23.05.04 built in July) with embedded pbr 1.1.1-7, so I've been able to move back and forth between versions, and I can confirm that my config works fine with the older pbr package.

I'm wondering if someone else is experiencing these issues:

Here's my config snippet for pbr

config pbr 'config'
	option enabled '1'
	option verbosity '2'
	option strict_enforcement '1'
	option resolver_set 'none'
	option ipv6_enabled '0'
	option boot_timeout '30'
	option rule_create_option 'add'
	option procd_reload_delay '1'
	option webui_show_ignore_target '0'
	list webui_supported_protocol 'all'
	list webui_supported_protocol 'tcp'
	list webui_supported_protocol 'udp'
	list webui_supported_protocol 'tcp udp'
	list webui_supported_protocol 'icmp'

config policy
	option name 'pbr-wg0'
	option src_addr '@br-lan.113'
	option dest_addr '!10.0.0.0/8 !169.254.0.0/16 !172.16.0.0/12 !192.168.0.0/16 !224.0.0.0/3'
	option interface 'wg0'

config policy
	option name 'pbr-wg1'
	option src_addr '@br-lan.114'
	option dest_addr '!10.0.0.0/8 !169.254.0.0/16 !172.16.0.0/12 !192.168.0.0/16 !224.0.0.0/3'
	option interface 'wg1'

config policy
	option name 'pbr-wg3'
	option src_addr '@br-lan.115'
	option dest_addr '!10.0.0.0/8 !169.254.0.0/16 !172.16.0.0/12 !192.168.0.0/16 !224.0.0.0/3'
	option interface 'wg3'
2

I came to the forum just now specifically to see if anyone else was having this issue..

I experienced the same on a Netgear r7800 I tried upgrading earlier today from 23.05.03 to 23.05.05. The version in 23.05.03 (1.1.1-7) starts and runs normally. The version in 23.05.05 (1.1.6-20) will not start.

I do not have any WG links, I use OpenVPN for the 'other' WAN.

Unfortunately, I don't have anything useful to contribute yet aside from a +1.

3

Thanks for the +1.

I can add that I'm running OpenWRT on Google WiFi. I really don't think the device is relevant, as the PBR packages are labeled as "-all", meaning they are the same for all platforms [quite possibly it is just a bunch of scripts].

4

Also, my wireguard links are fully operational in both 23.05.04 and 23.05.05, as well as other services dependent on them.

5

We are already on 1.1.7--15.
So I suggest you upgrade and test again.

6

I had some problems with 1.1.6-20 starting also. In my case the problem was in function is_lan in /etc/init.d/pbr:

is_lan() { local d; network_get_device d "$1"; str_contains "$d" 'br-lan'; }

I have a VLAN on br-lan that actually is wan so this function doesn't work for me. To fix my problem I changed "br-lan" in is_lan function to "br-lan.xyz" where "br-lan.xyz" is the actual lan VLAN device.

I don't know if this helps in your case, but thought I'd mention it.

(is_lan function hasn't changed to 1.1.7-15)

7

From the readme:

  • The WAN interface name is no longer auto-detected. If you use a non-standard name for WAN interface, you can set it in options.
  • If you use a non-standard name for LAN interface you can set it in options.
8

Br-lan is hardcoded here..

9

The new 1.1.7-15 version hasn't been propagated to the packages repository: https://downloads.openwrt.org/releases/23.05.5/packages/

It is still at 1.1.6-20.

10

Thank you for posting this. Would it have helped if in addition to procd_wan_interface there would be a list (procd_lan_interface) where you could define your LAN interfaces for the is_lan() function?

11

Sounds like that would work for me. But I'll let you decide if it makes sense to have this configuration option or if my setup is just "weird".

Thanks for your work on pbr!

12

It is already in the readme: https://docs.openwrt.melmac.net/pbr/#procd_lan_interface :slight_smile:

13

Should the interfaces listed in this option be the Linux interface names (e.g. eth1, eth2), or the logical OpenWrt interface names (e.g. lan, guest)?

I thought it would probably be the Linux interface name, but I looked through the code and the related procd_wan_interface option seems to default to wan in the code, which is the logical OpenWrt interface name (in my setup the WAN Linux interface is eth0). My WAN interface appears to be detected correctly without setting procd_wan_interface.

EDIT: Also, the procd_lan_interface option now seems to have been removed, although it's still described in the doc? Does this mean the option is no longer needed with 1.1.7?

14

Didn't realize that particular behavior changed. I had a little free time today to troubleshoot and re-read the readme. 1.1.6-20 started just fine once I defined the wan interface in the options. Lesson learned.

Thanks @egc

1 Like
15

There are multiple docs corresponding to different versions, they have different descriptions of this option.

16

The doc I was looking at was:

This lists the procd_lan_interface option, but it also says the doc is for v1.1.7-17, and the option doesn't seem to exist in that release.

I have "unusual" LAN interfaces, so I'm just trying to decide whether I need to worry about making sure I specify this option correctly (hence my questions about what type of interface names this option expects), or whether I can just ignore it completely and upgrade to the latest 1.1.7 release instead.

17

Do you have 1.1.7-17 installed? Do you have procd_lan_interface defined in config? Does it not work as intended?

18

I have 1.1.6-20 installed currently. I honestly don't know if the option works as intended, because it's not clear to me exactly what pbr uses it for (something do to with the nft reload killswitch?)

I'm currently using the appropriate Linux interface names (eth1, eth2 etc) in this option. Is that what I should be doing?

I wouldn't expect the option to do anything in 1.1.7-17, because it seems to have been removed in 1.1.7-5?:

But I'm not sure if I'm missing something here, because it's still described in the 1.1.7-17 doc.

19

Since this thread has gone cold, it seems that there are some fixes down the pipeline for people to catch up. While these changes propagate, it would be super useful if you rolled back PBR and its associated packages back to 1.1.1-7, so people can build working systems using the latest 23.05.05.

20

You can easily update to the latest pbr see: