Possible LuCI firewall zone creation bug

Installing and Using OpenWrt
1

I'm new to OpenWrt, so be gentle with me. I've googled for information on this, searched here in the forum, and checked the issue tracker with no luck.

If I create a new zone using LuCI, and give it the same name as the interface for the covered network, it fails to put an "option network" line in /etc/config/firewall. If I create the zone, save it, and come back and add the covered network, it works correctly. This is with OpenWrt 19.07.1 on a D-Link DIR-510L.

Steps to reproduce:

  • Network -> Firewall
  • Select "Add" in the Zones section
  • For "Name" pick a name exactly matching the network you plan to cover.
  • Select a single covered network matching the name from the previous step
  • Save
  • Save & Apply

The file /etc/config/firewall will contain a new "config zone" section that does not have an "option network" line. This results in the iptables chains being incorrectly created.

Has anyone else encountered this? I figured I'd ask here before needlessly filing a bug report. Thanks for any info or help.

2

I created one interface called test
Added IP/mask and didn't assign it to a zone.
Saved and applied.
Then I followed your steps.
The network appears in the config.

uci show firewall.@zone[4]
firewall.cfg3bdc81=zone
firewall.cfg3bdc81.input='REJECT'
firewall.cfg3bdc81.forward='REJECT'
firewall.cfg3bdc81.output='ACCEPT'
firewall.cfg3bdc81.name='test'
firewall.cfg3bdc81.network='test'

18.06.7, but someone with 19.07.1 can also try it.

3

Thanks, trendy, that's a useful data point. I tried uci show on my installation, and, just like the config file, it is missing the "network" entry.

4

It would be impossible to have a missmatch between uci show (or export) and the config file, as uci is reading the config files.

5

I can confirm. I have the same issue on a Ubiquiti EdgeRouter X running OpenWrt 19.07.1.

6

I recall assisting an OP in the forum. Their new Interface was not in a firewall zone...

I recall it because the OP noted how it used to work...

I'm trying to search for the thread... :thinking:

7

This was is LuCI logic to cater for the old pre-fw3 uci firewall which, in case of an unset option network, fell back to using option name. I removed this with https://github.com/openwrt/luci/commit/4052436d825e1e78d1734ddd4d06d2291fbc5684 and https://github.com/openwrt/luci/commit/663134cd2d6b9603d69f59665715586f77f4610a

3 Likes