Legacy rules detected
There are legacy iptables rules present on the system. Mixing iptables and nftables rules is discouraged and may lead to incomplete traffic filtering.
I suspect that it appeared due to the installation of docker.
How critical is this notification?
OpenWrt 23.05.3
Some modules plainly conflict - like mark and nat/masq if used from both sides at same time, some modules do not have nft equivalents, while still can be programmed via iptables-nft over the xt_bridge module
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/wireless
nft list ruleset | grep xt
root@OpenWrt:~# opkg whatdepends iptables-nft
Root set:
What depends on root set
root@OpenWrt:~# opkg whatdepends iptables-zz-legacy
Root set:
iptables-zz-legacy
What depends on root set
dockerd 27.1.1-1 depends on iptables
root@OpenWrt:~#
You have to uninstall all zz-legacy stuff, pre-install -nft stuff then install docker/mwan/pbr/upnp etc.
Warning is objective opinion on your broken firewall
In other words, @vlados, there is no guarantee that your firewall is working correctly. It is very likely broken.
If you do not mind that your firewall is probably not working correctly, then it is not critical at all.....
This is a known bug. If a package has a dependency on iptables listed in its OpenWrt makefile, then when installing that package, iptables-zz-legacy will be installed if iptables is not already available. (iptables is by default not preinstalled on OpenWrt 23.05.0 onwards.).
Although a PR to fix this by defaulting to iptables-nft was discussed, no-one that can merge such a PR was willing to do so, so tough luck, now we all have to deal with Legacy rules detected on the basis it would force maintainers of packages to migrate them to nftables. - This did not happen of course...
The actual workings depend on how 2 module sets hooks are ordered in kernel, dropped packets are dropped, maybe before other conntrack would like to pick up state, or nat-ed packets goes through other output, ctmark/mark becomes zero for other engine disbalancing mwan, try to settle it in one side as much as possible.
Oh, thanks for the clarification. I think I'll do a clean install without docker. it would be cool to have docker especially when there are a lot of resources available, but for me it's not a primary goal. by the way, what about procd init system? I read about it in the manual but didn't understand much (i have experience with docker, but i've been working with openwrt for a couple of days)
Install docker via luci - check for any legacy dependencies. You need (if i recall right) iptables-nft and ebtables-nft preinstalled, probably some others, but certainly not iptables-legacy. Irreplacable legacy kmods are OK as long as xt_bridge runs them under command of iptables-nft.