So, as far as I can tell, dnat doesn't work because CONFIG_MROUTE is not set and someone somewhere decided to just drop all packets for that address range instead of doing what I asked.
Anyway, I think the next solution is the mangle target, just overwrite the destination address directly. That's probably going to be more computationally expensive than dnat, which might have worked with NAT hardware acceleration but it won't be as expensive as routing all those packets through a userspace application like smcroute and do a second or maybe even third round trip through the CPU.
Now the question becomes, how can I use LuCI to create a mangle rule ?
I -think- the rule is as follows
table inet fw4 {
chain mangle_prerouting {
type filter hook prerouting priority mangle; policy accept;
iifname "eth0.2" udp dport 22223 ip daddr set 239.0.0.1 comment "Rewrite destination to 239.0.0.1"
}
}
But I've had a look aroung in
luci/admin/network/firewall/zones
luci/admin/network/firewall/forwards
luci/admin/network/firewall/rules
luci/admin/network/firewall/snats
Didn't find anything about a mangle rule action
There was a possible configution in firewall/snats, that was almost the right thing, as follows
but the action MANGLE is not there, I'm not sure if it would have been valid at this place
This is what the config looks like
uci add firewall nat # =cfg2c93c8
uci set firewall.@nat[-1].name='Forward UDP to Multicast'
uci add_list firewall.@nat[-1].proto='udp'
uci set firewall.@nat[-1].src='lan'
uci set firewall.@nat[-1].dest_port='9990'
uci set firewall.@nat[-1].target='SNAT'
uci set firewall.@nat[-1].snat_ip='239.0.0.1'
uci set firewall.@nat[-1].snat_port='9990'
I tried anyway, doesn't work, the description explains why
So it re-writes the SOURCE address but I need to rewrite the destination, so SNAT is not the right thing.
I was hoping maybe in traffic rules, but the only actions listed are
drop
accept
reject
don't track
assign conntrack helper
apply firewall mark
XOR firewall mark
DSCP classification
I tried creating something that looks right using uci
root@router:~# uci add firewall rule # Creates a new rule and returns a unique ID (e.g., `cfgXXXXXX`)
cfg2c92bd
root@router:~# uci set firewall.@rule[-1].name='Rewrite UDP to Multicast'
root@router:~# uci set firewall.@rule[-1].proto='udp' # Match UDP traffic
root@router:~# uci set firewall.@rule[-1].src='wan' # Match packets from the WAN zone
root@router:~# uci set firewall.@rule[-1].dest='lan' # Specify the LAN zone as the output
root@router:~# uci set firewall.@rule[-1].dest_port='22223' # Match destination port 22223
root@router:~# uci set firewall.@rule[-1].target='DNAT' # Set the rule's action to rewrite the packet
root@router:~# uci set firewall.@rule[-1].dest_ip='239.0.0.1' # Rewrite the destination address to the multicast group
root@router:~# uci set firewall.@rule[-1].family='ipv4' # Ensure the rule is applied to IPv4 traffic
root@router:~# uci set firewall.@rule[-1].table='mangle' # Place the rule in the mangle table
root@router:~# uci set firewall.@rule[-1].chain='prerouting' # Apply the rule in the prerouting chain
root@router:~#
root@router:~# # Commit and reload the firewall configuration
root@router:~# uci commit firewall
root@router:~# /etc/init.d/firewall reload
Section @rule[9] (Support-UDP-Traceroute) is disabled, ignoring section
Section @rule[11] (Rewrite UDP to Multicast) specifies unknown option 'table'
Section @rule[11] (Rewrite UDP to Multicast) specifies unknown option 'chain'
Section @redirect[8] (testrule1) is disabled, ignoring section
Section @redirect[24] (Forward UDP 22223 to multicast) is disabled, ignoring section
Section @include[0] is not marked as compatible with fw4, ignoring section
Section @include[0] requires 'option fw4_compatible 1' to be considered compatible
/dev/stdin:120:51-61: Error: Could not process rule: No such file or directory
ip daddr 239.0.0.1 udp dport 22223 counter jump dnat_to_lan comment "!fw4: Rewrite UDP to Multicast"
^^^^^^^^^^^
root@router:~#
Next I tried adding the rule to /etc/nftables.d/custom-rules.nft
nano /etc/nftables.d/custom-rules.nft
table inet fw4 {
chain prerouting {
type filter hook prerouting priority mangle; policy accept;
iif "eth0.2" udp dport 22223 ip daddr set 239.0.0.1 comment "Rewrite UDP to Multicast"
}
}
That does not work, with the following error
root@router:~# /etc/init.d/firewall reload
Section @rule[9] (Support-UDP-Traceroute) is disabled, ignoring section
Section @redirect[8] (testrule1) is disabled, ignoring section
Section @redirect[24] (Forward UDP 22223 to multicast) is disabled, ignoring section
Section @include[0] is not marked as compatible with fw4, ignoring section
Section @include[0] requires 'option fw4_compatible 1' to be considered compatible
In file included from /dev/stdin:20:2-33:
/etc/nftables.d/custom-rules.nft:1:1-5: Error: syntax error, unexpected table
table inet fw4 {
^^^^^
/dev/stdin:27:14-14: Error: syntax error, unexpected '{', expecting string
chain input {
^
/dev/stdin:28:3-6: Error: syntax error, unexpected type
type filter hook input priority filter; policy accept;
^^^^
/dev/stdin:28:43-48: Error: syntax error, unexpected policy
type filter hook input priority filter; policy accept;
^^^^^^
/dev/stdin:30:3-9: Error: syntax error, unexpected iifname
iifname "lo" accept comment "!fw4: Accept traffic from loopback"
^^^^^^^
/dev/stdin:32:6-10: Error: syntax error, unexpected state, expecting timeout or expectation or helper
ct state established,related accept comment "!fw4: Allow inbound established and related flows"
^^^^^
/dev/stdin:33:3-5: Error: syntax error, unexpected tcp
tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "!fw4: Rate limit TCP syn packets"
^^^
/dev/stdin:34:3-6: Error: syntax error, unexpected meta
meta l4proto udp counter accept comment "!fw4: Allow UDP"
^^^^
/dev/stdin:35:3-9: Error: syntax error, unexpected iifname
iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
^^^^^^^
/dev/stdin:36:3-9: Error: syntax error, unexpected iifname
iifname "eth0.2" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
^^^^^^^
Chatgpt claims this is because
The issue here stems from directly pasting an entire nftables configuration block (table inet fw4) into /etc/nftables.d/custom-rules.nft. This approach does not work in OpenWrt because the custom-rules.nft file is not a full ruleset file, but a fragment of rules that is inserted into the main fw4 ruleset. You cannot redefine tables or chains in this file.
It then suggests the following syntax
iif "eth0.2" udp dport 22223 ip daddr set 239.0.0.1 comment "Rewrite UDP to Multicast"
And that's not valid either
root@router:~# nano /etc/nftables.d/custom-rules.nft
root@router:~# /etc/init.d/firewall reload
Section @rule[9] (Support-UDP-Traceroute) is disabled, ignoring section
Section @redirect[8] (testrule1) is disabled, ignoring section
Section @redirect[24] (Forward UDP 22223 to multicast) is disabled, ignoring section
Section @include[0] is not marked as compatible with fw4, ignoring section
Section @include[0] requires 'option fw4_compatible 1' to be considered compatible
In file included from /dev/stdin:20:2-33:
/etc/nftables.d/custom-rules.nft:1:1-3: Error: syntax error, unexpected iif
iif "eth0.2" udp dport 22223 ip daddr set 239.0.0.1 comment "Rewrite UDP to Multicast"
^^^
root@router:~#
Then I got this next formulation, also doesn't work
root@router:~# nano /etc/nftables.d/custom-rules.nft
root@router:~# cat /etc/nftables.d/custom-rules.nft
ip protocol udp iif "eth0.2" udp dport 22223 ip daddr set 239.0.0.1 comment "Rewrite UDP to Multicast"
root@router:~# nft -c -f /etc/nftables.d/custom-rules.nft
/etc/nftables.d/custom-rules.nft:1:4-11: Error: syntax error, unexpected protocol, expecting string
ip protocol udp iif "eth0.2" udp dport 22223 ip daddr set 239.0.0.1 comment "Rewrite UDP to Multicast"
^^^^^^^^
root@router:~# /etc/init.d/firewall reload
Section @rule[9] (Support-UDP-Traceroute) is disabled, ignoring section
Section @redirect[8] (testrule1) is disabled, ignoring section
Section @redirect[24] (Forward UDP 22223 to multicast) is disabled, ignoring section
Section @include[0] is not marked as compatible with fw4, ignoring section
Section @include[0] requires 'option fw4_compatible 1' to be considered compatible
In file included from /dev/stdin:20:2-33:
/etc/nftables.d/custom-rules.nft:1:1-2: Error: syntax error, unexpected ip
ip protocol udp iif "eth0.2" udp dport 22223 ip daddr set 239.0.0.1 comment "Rewrite UDP to Multicast"
^^
It also suggested
ip daddr 239.0.0.1 udp dport 22223 iif "eth0.2" counter ip daddr set 239.0.0.1 comment "Rewrite UDP to Multicast"
That doesn't work
It also suggested
table inet fw4 {
chain mangle_prerouting {
type filter hook prerouting priority mangle; policy accept;
udp dport 22223 iif "eth0.2" ip daddr set 239.0.0.1 comment "Rewrite UDP to Multicast"
}
}
That doesn't work
I am running out of options and permutations .....
