Possible LuCI firewall zone creation bug

I'm new to OpenWrt, so be gentle with me. I've googled for information on this, searched here in the forum, and checked the issue tracker with no luck.

If I create a new zone using LuCI, and give it the same name as the interface for the covered network, it fails to put an "option network" line in /etc/config/firewall. If I create the zone, save it, and come back and add the covered network, it works correctly. This is with OpenWrt 19.07.1 on a D-Link DIR-510L.

Steps to reproduce:

  • Network -> Firewall
  • Select "Add" in the Zones section
  • For "Name" pick a name exactly matching the network you plan to cover.
  • Select a single covered network matching the name from the previous step
  • Save
  • Save & Apply

The file /etc/config/firewall will contain a new "config zone" section that does not have an "option network" line. This results in the iptables chains being incorrectly created.

Has anyone else encountered this? I figured I'd ask here before needlessly filing a bug report. Thanks for any info or help.

I created one interface called test
Added IP/mask and didn't assign it to a zone.
Saved and applied.
Then I followed your steps.
The network appears in the config.

uci show firewall.@zone[4]
firewall.cfg3bdc81=zone
firewall.cfg3bdc81.input='REJECT'
firewall.cfg3bdc81.forward='REJECT'
firewall.cfg3bdc81.output='ACCEPT'
firewall.cfg3bdc81.name='test'
firewall.cfg3bdc81.network='test'

18.06.7, but someone with 19.07.1 can also try it.

Thanks, trendy, that's a useful data point. I tried uci show on my installation, and, just like the config file, it is missing the "network" entry.

It would be impossible to have a missmatch between uci show (or export) and the config file, as uci is reading the config files.

I can confirm. I have the same issue on a Ubiquiti EdgeRouter X running OpenWrt 19.07.1.

I recall assisting an OP in the forum. Their new Interface was not in a firewall zone...

I recall it because the OP noted how it used to work...

I'm trying to search for the thread... :thinking:

This was is LuCI logic to cater for the old pre-fw3 uci firewall which, in case of an unset option network, fell back to using option name. I removed this with https://github.com/openwrt/luci/commit/4052436d825e1e78d1734ddd4d06d2291fbc5684 and https://github.com/openwrt/luci/commit/663134cd2d6b9603d69f59665715586f77f4610a

3 Likes