Hello!
There is a router with a pure openwrt (22.03 and 23.05 v), (I haven't made any changes to the default settings yet to verify the problem) the Internet works, other devices recognize the router and have access to the Internet through it. The blockcheck works from other devices connected to this router.
I've researched readme and other documentation. After installing the necessary programs, launched the blockcheck.sh
Expected behavior: Sending packages to the ISP for finding a working strategy
Behaviour in live: : After a successful initial check of the DNS and redirects to the ISP page without DPI bypass, as well as the expected the IP block test result, a connection error (tpws) to 127.0.0.1 port 1993 and (nfqws) connection timed out occurs.
blockcheck part of the result (the router is located in Russia)
* checking system
Linux detected
firewall type is nftables
* checking privileges
* checking prerequisites
* checking DNS
system DNS is working
comparing system resolver to public DNS : 8.8.8.8
pornhub.com : OK
ntc.party : OK
rutracker.org : OK
www.torproject.org : OK
bbc.com : OK
checking resolved IP uniqueness for : pornhub.com ntc.party rutracker.org www.torproject.org bbc.com
censor's DNS can return equal result for multiple blocked domains.
all resolved IPs are unique
-- DNS looks good
-- NOTE this check is Russia targeted. In your country other domains may be blocked.
* checking virtualization
cannot detect
* port block tests ipv4 rutracker.org:80
nc -z -w 1 104.21.32.39 80
104.21.32.39 connects
nc -z -w 1 172.67.182.196 80
172.67.182.196 connects
* curl_test_http ipv4 rutracker.org
- checking without DPI bypass
[attempt 1] suspicious redirection 307 to : ISP page
[attempt 2] suspicious redirection 307 to : ISP page
UNAVAILABLE
- IP block tests (requires manual interpretation)
> testing iana.org on it's original ip
[attempt 1] AVAILABLE
[attempt 2] AVAILABLE
!!!!! AVAILABLE !!!!!
> testing rutracker.org on 192.0.43.8 (iana.org)
[attempt 1] HTTP/1.1 307 Temporary Redirect
Location:
AVAILABLE
[attempt 2] HTTP/1.1 307 Temporary Redirect
Location:
AVAILABLE
> testing iana.org on 104.21.32.39 (rutracker.org)
[attempt 1] HTTP/1.1 409 Conflict
AVAILABLE
[attempt 2] HTTP/1.1 409 Conflict
AVAILABLE
> testing iana.org on 172.67.182.196 (rutracker.org)
[attempt 1] curl: (28) Connection timed out after 2002 milliseconds
[attempt 2] HTTP/1.1 409 Conflict
AVAILABLE
- checking tpws --hostcase
[attempt 1] curl: (7) Failed to connect to 127.0.0.1 port 1993 after 1 ms: Error
[attempt 2] curl: (7) Failed to connect to 127.0.0.1 port 1993 after 1 ms: Error
UNAVAILABLE code=7
- checking tpws --hostspell=hoSt
[attempt 1] curl: (7) Failed to connect to 127.0.0.1 port 1993 after 1 ms: Error
[attempt 2] curl: (7) Failed to connect to 127.0.0.1 port 1993 after 1 ms: Error
UNAVAILABLE code=7
- checking tpws --hostdot
[attempt 1] curl: (7) Failed to connect to 127.0.0.1 port 1993 after 1 ms: Error
[attempt 2] curl: (7) Failed to connect to 127.0.0.1 port 1993 after 1 ms: Error
UNAVAILABLE code=7
- checking tpws --hosttab
[attempt 1] curl: (7) Failed to connect to 127.0.0.1 port 1993 after 1 ms: Error
[attempt 2] curl: (7) Failed to connect to 127.0.0.1 port 1993 after 1 ms: Error
UNAVAILABLE code=7
- checking tpws --hostnospace
[attempt 1] curl: (7) Failed to connect to 127.0.0.1 port 1993 after 1 ms: Error
[attempt 2] curl: (7) Failed to connect to 127.0.0.1 port 1993 after 1 ms: Error
UNAVAILABLE code=7
- checking tpws --domcase
[attempt 1] curl: (7) Failed to connect to 127.0.0.1 port 1993 after 1 ms: Error
[attempt 2] curl: (7) Failed to connect to 127.0.0.1 port 1993 after 1 ms: Error
UNAVAILABLE code=7
....
curl_test_http: tpws strategy for ipv4 rutracker.org not found
preparing nfqws redirection
- checking nfqws --hostcase
[attempt 1] curl: (28) Connection timed out after 2002 milliseconds
[attempt 2] curl: (28) Connection timed out after 2002 milliseconds
UNAVAILABLE code=28
- checking nfqws --hostspell=hoSt
[attempt 1] curl: (28) Connection timed out after 2002 milliseconds
[attempt 2] curl: (28) Connection timed out after 2002 milliseconds
UNAVAILABLE code=28
- checking nfqws --hostnospace
[attempt 1] curl: (28) Connection timed out after 2002 milliseconds
[attempt 2] curl: (28) Connection timed out after 2002 milliseconds
UNAVAILABLE code=28
- checking nfqws --domcase
[attempt 1] curl: (28) Connection timed out after 2002 milliseconds
[attempt 2] curl: (28) Connection timed out after 2002 milliseconds
UNAVAILABLE code=28
- checking nfqws --dpi-desync=split2
[attempt 1] curl: (28) Connection timed out after 2002 milliseconds
[attempt 2] curl: (28) Connection timed out after 2002 milliseconds
UNAVAILABLE code=28
...
However, from a device connected to this router, the blockcheck working successfully. But when configuring the config and installing Zapret on the router, there is no expected result. The internet behavies as if the rules don't work.
config
# this file is included from init scripts
# change values here
# can help in case /tmp has not enough space
#TMPDIR=/opt/zapret/tmp
# redefine user for zapret daemons. required on Keenetic
#WS_USER=nobody
# override firewall type : iptables,nftables,ipfw
FWTYPE=nftables
# options for ipsets
# maximum number of elements in sets. also used for nft sets
SET_MAXELEM=522288
# too low hashsize can cause memory allocation errors on low RAM systems , even if RAM is enough
# too large hashsize will waste lots of RAM
IPSET_OPT="hashsize 262144 maxelem $SET_MAXELEM"
# dynamically generate additional ip. $1 = ipset/nfset/table name
#IPSET_HOOK="/etc/zapret.ipset.hook"
# options for ip2net. "-4" or "-6" auto added by ipset create script
IP2NET_OPT4="--prefix-length=22-30 --v4-threshold=3/4"
IP2NET_OPT6="--prefix-length=56-64 --v6-threshold=5"
# options for auto hostlist
AUTOHOSTLIST_RETRANS_THRESHOLD=3
AUTOHOSTLIST_FAIL_THRESHOLD=3
AUTOHOSTLIST_FAIL_TIME=60
# 1 = debug autohostlist positives to ipset/zapret-hosts-auto-debug.log
AUTOHOSTLIST_DEBUGLOG=1
# number of parallel threads for domain list resolves
MDIG_THREADS=30
# ipset/*.sh can compress large lists
GZIP_LISTS=1
# command to reload ip/host lists after update
# comment or leave empty for auto backend selection : ipset or ipfw if present
# on BSD systems with PF no auto reloading happens. you must provide your own command
# set to "-" to disable reload
#LISTS_RELOAD="pfctl -f /etc/pf.conf"
# override ports
#HTTP_PORTS=80-81,85
#HTTPS_PORTS=443,500-501
#QUIC_PORTS=443,444
# CHOOSE OPERATION MODE
# MODE : nfqws,tpws,tpws-socks,filter,custom
# nfqws : nfqws for dpi desync
# tpws : tpws transparent mode
# tpws-socks : tpws socks mode
# filter : no daemon, just create ipset or download hostlist
# custom : custom mode. should modify custom init script and add your own code
MODE=nfqws
# apply fooling to http
MODE_HTTP=1
# for nfqws only. support http keep alives. enable only if DPI checks for http request in any outgoing packet
MODE_HTTP_KEEPALIVE=1
# apply fooling to https
MODE_HTTPS=1
# apply fooling to quic
MODE_QUIC=0
# none,ipset,hostlist,autohostlist
MODE_FILTER=none
# CHOOSE NFQWS DAEMON OPTIONS for DPI desync mode. run "nfq/nfqws --help" for option list
DESYNC_MARK=0x40000000
DESYNC_MARK_POSTNAT=0x20000000
NFQWS_OPT_DESYNC="--debug=1 --dpi-desync=fake,split2 --dpi-desync-any-protocol=1 --dpi-desync-ttl=9 --dpi-desync-fooling=md5sig"
NFQWS_OPT_DESYNC_HTTP="--debug=syslog --dpi-desync=fake --dpi-desync-fooling=md5sig --dpi-desync-fake-http=0x00000000"
NFQWS_OPT_DESYNC_HTTPS="--debug=syslog --dpi-desync=fake --dpi-desync-ttl=9 --dpi-desync-fooling=md5sig"
#NFQWS_OPT_DESYNC_HTTP6="--debug=1 --dpi-desync=split --dpi-desync-ttl=5 --dpi-desync-fooling=none"
#NFQWS_OPT_DESYNC_HTTPS6="--debug=1 --wssize=1:6 --dpi-desync=split --dpi-desync-ttl=5 --dpi-desync-fooling=none"
NFQWS_OPT_DESYNC_QUIC="--debug=1 --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=md5sig"
#NFQWS_OPT_DESYNC_QUIC6="--debug=1 --dpi-desync=hopbyhop"
# CHOOSE TPWS DAEMON OPTIONS. run "tpws/tpws --help" for option list
TPWS_OPT="--hostspell=HOST --split-http-req=method --split-pos=3 --oob"
# openwrt only : donttouch,none,software,hardware
FLOWOFFLOAD=hardware
# openwrt: specify networks to be treated as LAN. default is "lan"
OPENWRT_LAN="lan"
# openwrt: specify networks to be treated as WAN. default wans are interfaces with default route
#OPENWRT_WAN4="wan vpn"
#OPENWRT_WAN6="wan6 vpn6"
# for routers based on desktop linux and macos. has no effect in openwrt.
# CHOOSE LAN and optinally WAN/WAN6 NETWORK INTERFACES
# or leave them commented if its not router
# it's possible to specify multiple interfaces like this : IFACE_LAN="eth0 eth1 eth2"
# if IFACE_WAN6 is not defined it take the value of IFACE_WAN
#IFACE_LAN=eth0
#IFACE_WAN=eth1
#IFACE_WAN6="ipsec0 wireguard0 he_net"
# should start/stop command of init scripts apply firewall rules ?
# not applicable to openwrt with firewall3+iptables
INIT_APPLY_FW=1
# firewall apply hooks
#INIT_FW_PRE_UP_HOOK="/etc/firewall.zapret.hook.pre_up"
#INIT_FW_POST_UP_HOOK="/etc/firewall.zapret.hook.post_up"
#INIT_FW_PRE_DOWN_HOOK="/etc/firewall.zapret.hook.pre_down"
#INIT_FW_POST_DOWN_HOOK="/etc/firewall.zapret.hook.post_down"
# do not work with ipv4
#DISABLE_IPV4=1
# do not work with ipv6
DISABLE_IPV6=1
# select which init script will be used to get ip or host list
# possible values : get_user.sh get_antizapret.sh get_combined.sh get_reestr.sh get_hostlist.sh
# comment if not required
#GETLIST=
Debug nfqws (logread check, I did not find any other methods of debug checks in the documentation) (Just typing "nfqws" with debug into the console, like other issues can't do anything and I guess shouldn't)
Mon Sep 2 19:19:47 2024 user.debug nfqws[2856]: read 4 bytes from hex string
Mon Sep 2 19:19:47 2024 user.debug nfqws[2856]: initializing conntrack with timeouts tcp=60:300:60 udp=60
Mon Sep 2 19:19:47 2024 user.debug nfqws[2856]: opening library handle
Mon Sep 2 19:19:47 2024 user.debug nfqws[2856]: unbinding existing nf_queue handler for AF_INET (if any)
Mon Sep 2 19:19:47 2024 user.debug nfqws[2856]: binding nfnetlink_queue as nf_queue handler for AF_INET
Mon Sep 2 19:19:47 2024 user.debug nfqws[2856]: binding this socket to queue '200'
Mon Sep 2 19:19:47 2024 user.debug nfqws[2856]: setting copy_packet mode
Mon Sep 2 19:19:47 2024 user.debug nfqws[2856]: initializing raw sockets bind-fix4=0 bind-fix6=0
Mon Sep 2 19:19:47 2024 user.debug nfqws[2856]: set_socket_buffers fd=5 rcvbuf=2048 sndbuf=32768
Mon Sep 2 19:19:47 2024 user.debug nfqws[2856]: fd=5 SO_RCVBUF=4096
Mon Sep 2 19:19:47 2024 user.debug nfqws[2856]: fd=5 SO_SNDBUF=65536
Mon Sep 2 19:19:47 2024 user.debug nfqws[2856]: set_socket_buffers fd=6 rcvbuf=2048 sndbuf=32768
Mon Sep 2 19:19:47 2024 user.debug nfqws[2856]: fd=6 SO_RCVBUF=4096
Mon Sep 2 19:19:47 2024 user.debug nfqws[2856]: fd=6 SO_SNDBUF=65536
Mon Sep 2 19:19:47 2024 user.debug nfqws[2857]: initializing conntrack with timeouts tcp=60:300:60 udp=60
Mon Sep 2 19:19:47 2024 user.debug nfqws[2857]: opening library handle
Mon Sep 2 19:19:47 2024 user.debug nfqws[2857]: unbinding existing nf_queue handler for AF_INET (if any)
Mon Sep 2 19:19:47 2024 user.debug nfqws[2857]: binding nfnetlink_queue as nf_queue handler for AF_INET
Mon Sep 2 19:19:47 2024 user.debug nfqws[2857]: binding this socket to queue '201'
Mon Sep 2 19:19:47 2024 user.debug nfqws[2857]: setting copy_packet mode
Mon Sep 2 19:19:47 2024 user.debug nfqws[2857]: initializing raw sockets bind-fix4=0 bind-fix6=0
Mon Sep 2 19:19:47 2024 user.debug nfqws[2857]: set_socket_buffers fd=5 rcvbuf=2048 sndbuf=32768
Mon Sep 2 19:19:47 2024 user.debug nfqws[2857]: fd=5 SO_RCVBUF=4096
Mon Sep 2 19:19:47 2024 user.debug nfqws[2857]: fd=5 SO_SNDBUF=65536
Mon Sep 2 19:19:47 2024 user.debug nfqws[2857]: set_socket_buffers fd=6 rcvbuf=2048 sndbuf=32768
Mon Sep 2 19:19:47 2024 user.debug nfqws[2857]: fd=6 SO_RCVBUF=4096
Mon Sep 2 19:19:47 2024 user.debug nfqws[2857]: fd=6 SO_SNDBUF=65536
table inet fw4 before installation Zapret
```
```
table inet fw4 {
chain input {
type filter hook input priority filter; policy accept;
iifname "lo" accept comment "!fw4: Accept traffic from loopback"
ct state established,related accept comment "!fw4: Allow inbound established and related flows"
tcp flags syn / fin,syn,rst,ack jump syn_flood comment "!fw4: Rate limit TCP syn packets"
iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
iifname "eth1" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
}
chain forward {
type filter hook forward priority filter; policy drop;
ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
iifname "eth1" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
jump handle_reject
}
chain output {
type filter hook output priority filter; policy accept;
oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state established,related accept comment "!fw4: Allow outbound established and related flows"
oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
oifname "eth1" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
}
chain prerouting {
type filter hook prerouting priority filter; policy accept;
iifname "br-lan" jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment"
}
chain handle_reject {
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject comment "!fw4: Reject any other traffic"
}
chain syn_flood {
limit rate 25/second burst 50 packets return comment "!fw4: Accept SYN packets below rate-limit"
drop comment "!fw4: Drop excess packets"
}
chain input_lan {
jump accept_from_lan
}
chain output_lan {
jump accept_to_lan
}
chain forward_lan {
jump accept_to_wan comment "!fw4: Accept lan to wan forwarding"
jump accept_to_lan
}
chain helper_lan {
}
chain accept_from_lan {
iifname "br-lan" counter packets 88 bytes 6607 accept comment "!fw4: accept lan IPv4/IPv6 traffic"
}
chain accept_to_lan {
oifname "br-lan" counter packets 32 bytes 4495 accept comment "!fw4: accept lan IPv4/IPv6 traffic"
}
chain input_wan {
meta nfproto ipv4 udp dport 68 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCP-Renew"
icmp type echo-request counter packets 0 bytes 0 accept comment "!fw4: Allow-Ping"
meta nfproto ipv4 meta l4proto igmp counter packets 0 bytes 0 accept comment "!fw4: Allow-IGMP"
meta nfproto ipv6 udp dport 546 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCPv6"
ip6 saddr fe80::/10 icmpv6 type . icmpv6 code { mld-listener-query . no-route, mld-listener-report . no-route, mld-listener-done . no-route, mld2-listener-report . no-route } counter packets 0 bytes 0 accept comment "!fw4: Allow-MLD"
icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply, nd-router-solicit, nd-router-advert } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Input"
icmpv6 type . icmpv6 code { packet-too-big . no-route, parameter-problem . no-route, parameter-problem . admin-prohibited, nd-neighbor-solicit . no-route, nd-neighbor-advert . no-route } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Input"
jump reject_from_wan
}
chain output_wan {
jump accept_to_wan
}
chain forward_wan {
icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
icmpv6 type . icmpv6 code { packet-too-big . no-route, parameter-problem . no-route, parameter-problem . admin-prohibited } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
meta l4proto esp counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: Allow-IPSec-ESP"
udp dport 500 counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: Allow-ISAKMP"
jump reject_to_wan
}
chain accept_to_wan {
oifname "eth1" counter packets 3599 bytes 230699 accept comment "!fw4: accept wan IPv4/IPv6 traffic"
}
chain reject_from_wan {
iifname "eth1" counter packets 18 bytes 4257 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
}
chain reject_to_wan {
oifname "eth1" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
}
chain dstnat {
type nat hook prerouting priority dstnat; policy accept;
}
chain srcnat {
type nat hook postrouting priority srcnat; policy accept;
oifname "eth1" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
}
chain srcnat_wan {
meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic"
}
chain raw_prerouting {
type filter hook prerouting priority raw; policy accept;
}
chain raw_output {
type filter hook output priority raw; policy accept;
}
chain mangle_prerouting {
type filter hook prerouting priority mangle; policy accept;
}
chain mangle_postrouting {
type filter hook postrouting priority mangle; policy accept;
}
chain mangle_input {
type filter hook input priority mangle; policy accept;
}
chain mangle_output {
type route hook output priority mangle; policy accept;
}
chain mangle_forward {
type filter hook forward priority mangle; policy accept;
iifname "eth1" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 ingress MTU fixing"
oifname "eth1" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 egress MTU fixing"
}
}
I assume that the problem is in the firewall settings, which for some reason are standard for this device in the current versions of openwrt. I will be grateful for constructive thoughts and ideas, because I obviously do not yet have enough qualifications to completely fix the problem.
fw4 stop and nft flush ruleset - does not give any changes in behavior
nft list ruleset after Zapret installation
table inet zapret {
set zapret {
type ipv4_addr
policy memory
size 522288
flags interval
auto-merge
}
set ipban {
type ipv4_addr
policy memory
size 522288
flags interval
auto-merge
}
set nozapret {
type ipv4_addr
policy memory
size 65536
flags interval
auto-merge
elements = { 10.0.0.0/8, 169.254.0.0/16,
172.16.0.0/12, 192.168.0.0/16 }
}
set lanif {
type ifname
elements = { "br-lan" }
}
set wanif {
type ifname
elements = { "eth1" }
}
set wanif6 {
type ifname
}
map link_local {
type ifname : ipv6_addr
}
flowtable ft {
hook ingress priority filter - 1
flags offload
}
chain dnat_output {
type nat hook output priority -101; policy accept;
}
chain dnat_pre {
type nat hook prerouting priority dstnat - 1; policy accept;
}
chain forward {
type filter hook forward priority filter - 1; policy accept;
oifname @wanif jump flow_offload
oifname @wanif6 jump flow_offload
}
chain input {
type filter hook input priority filter - 1; policy accept;
iif != "lo" jump localnet_protect
}
chain flow_offload {
tcp dport 80 ip daddr != @nozapret return comment "direct flow offloading exemption"
tcp dport 443 ct original packets 1-6 ip daddr != @nozapret return comment "direct flow offloading exemption"
meta l4proto { tcp, udp } flow add @ft
meta l4proto { tcp, udp } counter packets 34 bytes 2071 comment "if offload works here must not be too much traffic"
}
chain localnet_protect {
ip daddr 127.0.0.127 return comment "route_localnet allow access to tpws"
ip daddr 127.0.0.0/8 drop comment "route_localnet remote access protection"
}
chain postrouting {
type filter hook postrouting priority srcnat - 1; policy accept;
}
chain postnat {
type filter hook postrouting priority srcnat + 1; policy accept;
oifname @wanif tcp dport 80 meta mark & 0x40000000 == 0x00000000 ip daddr != @nozapret meta mark set meta mark | 0x20000000 queue flags bypass to 200
oifname @wanif tcp dport 443 ct original packets 1-6 meta mark & 0x40000000 == 0x00000000 ip daddr != @nozapret meta mark set meta mark | 0x20000000 queue flags bypass to 201
}
chain prerouting {
type filter hook prerouting priority dstnat + 1; policy accept;
}
chain prenat {
type filter hook prerouting priority dstnat - 1; policy accept;
iifname @wanif ct reply packets 1 tcp sport 80 ip saddr != @nozapret queue flags bypass to 200
iifname @wanif tcp sport 443 ct reply packets 1 ip saddr != @nozapret queue flags bypass to 201
}
chain predefrag {
type filter hook output priority -401; policy accept;
meta mark & 0x40000000 != 0x00000000 jump predefrag_nfqws comment "nfqws generated : avoid drop by INVALID conntrack state"
}
chain predefrag_nfqws {
meta mark & 0x20000000 != 0x00000000 notrack comment "postnat traffic"
ip frag-off != 0 notrack comment "ipfrag"
exthdr frag exists notrack comment "ipfrag"
tcp flags ! syn,rst,ack notrack comment "datanoack"
}
}
table inet fw4 {
chain input {
type filter hook input priority filter; policy accept;
iifname "lo" accept comment "!fw4: Accept traffic from loopback"
ct state established,related accept comment "!fw4: Allow inbound established and related flows"
tcp flags syn / fin,syn,rst,ack jump syn_flood comment "!fw4: Rate limit TCP syn packets"
iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
iifname "eth1" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
}
chain forward {
type filter hook forward priority filter; policy drop;
ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
iifname "eth1" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
jump handle_reject
}
chain output {
type filter hook output priority filter; policy accept;
oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state established,related accept comment "!fw4: Allow outbound established and related flows"
oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
oifname "eth1" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
}
chain prerouting {
type filter hook prerouting priority filter; policy accept;
iifname "br-lan" jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment"
}
chain handle_reject {
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject comment "!fw4: Reject any other traffic"
}
chain syn_flood {
limit rate 25/second burst 50 packets return comment "!fw4: Accept SYN packets below rate-limit"
drop comment "!fw4: Drop excess packets"
}
chain input_lan {
jump accept_from_lan
}
chain output_lan {
jump accept_to_lan
}
chain forward_lan {
jump accept_to_wan comment "!fw4: Accept lan to wan forwarding"
jump accept_to_lan
}
chain helper_lan {
}
chain accept_from_lan {
iifname "br-lan" counter packets 0 bytes 0 accept comment "!fw4: accept lan IPv4/IPv6 traffic"
}
chain accept_to_lan {
oifname "br-lan" counter packets 0 bytes 0 accept comment "!fw4: accept lan IPv4/IPv6 traffic"
}
chain input_wan {
meta nfproto ipv4 udp dport 68 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCP-Renew"
icmp type echo-request counter packets 0 bytes 0 accept comment "!fw4: Allow-Ping"
meta nfproto ipv4 meta l4proto igmp counter packets 0 bytes 0 accept comment "!fw4: Allow-IGMP"
meta nfproto ipv6 udp dport 546 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCPv6"
ip6 saddr fe80::/10 icmpv6 type . icmpv6 code { mld-listener-query . no-route, mld-listener-report . no-route, mld-listener-done . no-route, mld2-listener-report . no-route } counter packets 0 bytes 0 accept comment "!fw4: Allow-MLD"
icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply, nd-router-solicit, nd-router-advert } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Input"
icmpv6 type . icmpv6 code { packet-too-big . no-route, parameter-problem . no-route, parameter-problem . admin-prohibited, nd-neighbor-solicit . no-route, nd-neighbor-advert . no-route } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Input"
jump reject_from_wan
}
chain output_wan {
jump accept_to_wan
}
chain forward_wan {
icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
icmpv6 type . icmpv6 code { packet-too-big . no-route, parameter-problem . no-route, parameter-problem . admin-prohibited } limit rate 1000/second counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
meta l4proto esp counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: Allow-IPSec-ESP"
udp dport 500 counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: Allow-ISAKMP"
jump reject_to_wan
}
chain accept_to_wan {
oifname "eth1" counter packets 31 bytes 1950 accept comment "!fw4: accept wan IPv4/IPv6 traffic"
}
chain reject_from_wan {
iifname "eth1" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
}
chain reject_to_wan {
oifname "eth1" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
}
chain dstnat {
type nat hook prerouting priority dstnat; policy accept;
}
chain srcnat {
type nat hook postrouting priority srcnat; policy accept;
oifname "eth1" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
}
chain srcnat_wan {
meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic"
}
chain raw_prerouting {
type filter hook prerouting priority raw; policy accept;
}
chain raw_output {
type filter hook output priority raw; policy accept;
}
chain mangle_prerouting {
type filter hook prerouting priority mangle; policy accept;
}
chain mangle_postrouting {
type filter hook postrouting priority mangle; policy accept;
}
chain mangle_input {
type filter hook input priority mangle; policy accept;
}
chain mangle_output {
type route hook output priority mangle; policy accept;
}
chain mangle_forward {
type filter hook forward priority mangle; policy accept;
iifname "eth1" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 ingress MTU fixing"
oifname "eth1" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 egress MTU fixing"
}
}
There is a router with Openwrt installed and standard settings:
network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix '..#..'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
config interface 'wan'
option device 'eth1'
option proto 'dhcp'
config interface 'wan6'
option device 'eth1'
option proto 'dhcpv6'
firewall
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
Router model - Edgerouter lite
Russian translation
Привет! Есть роутер с чистым openwrt (22.03 и 23.05 v), (я пока не вносил никаких изменений в настройки по умолчанию для проверки проблемы) интернет работает, другие устройства узнают роутер и имеют доступ к интернету через него. Проверка блокировки работает с других устройств, подключенных к этому роутеру. Я изучил readme и другую документацию. После установки необходимых программ, запустили blockcheck.sh Ожидаемое поведение: Отправка пакетов провайдеру для поиска рабочей стратегии Поведение в реальном времени: : После успешной первичной проверки DNS и редиректов на страницу провайдера без обхода DPI, а также ожидаемого результата теста блока IP, происходит ошибка соединения (tpws) к порту 127.0.0.1 1993 и (nfqws) истекло время ожидания соединения.
Однако с устройства, подключенного к этому роутеру, проверка блокировки работает успешно. Но при настройке конфига и установке Zapret на роутер ожидаемого результата нет. Интернет ведет себя так, как будто правила не работают.
Предполагаю, что проблема в настройках файрвола, которые почему-то являются стандартными для данного устройства в актуальных версиях openwrt. Буду благодарен за конструктивные мысли и идеи, потому что у меня явно пока недостаточно квалификации, чтобы полностью решить проблему.
Набор правил FW4 Stop и сброса NFT - не дает никаких изменений в поведении
Thank you and Best Regards
Спасибо и с наилучшими пожеланиями
Hello!
There is a router with a pure openwrt (22.03 and 23.05 v), (I haven't made any changes to the default settings yet to verify the problem) the Internet works, other devices recognize the router and have access to the Internet through it. The blockcheck works from other devices connected to this router.
I've researched readme and other documentation. After installing the necessary programs, launched the blockcheck.sh
Expected behavior: Sending packages to the ISP for finding a working strategy
Behaviour in live: : After a successful initial check of the DNS and redirects to the ISP page without DPI bypass, as well as the expected the IP block test result, a connection error (tpws) to 127.0.0.1 port 1993 and (nfqws) connection timed out occurs.
blockcheck part of the result (the router is located in Russia)
* checking system
Linux detected
firewall type is nftables
* checking privileges
* checking prerequisites
* checking DNS
system DNS is working
comparing system resolver to public DNS : 8.8.8.8
pornhub.com : OK
ntc.party : OK
rutracker.org : OK
www.torproject.org : OK
bbc.com : OK
checking resolved IP uniqueness for : pornhub.com ntc.party rutracker.org www.torproject.org bbc.com
censor's DNS can return equal result for multiple blocked domains.
all resolved IPs are unique
-- DNS looks good
-- NOTE this check is Russia targeted. In your country other domains may be blocked.
* checking virtualization
cannot detect
* port block tests ipv4 rutracker.org:80
nc -z -w 1 104.21.32.39 80
104.21.32.39 connects
nc -z -w 1 172.67.182.196 80
172.67.182.196 connects
* curl_test_http ipv4 rutracker.org
- checking without DPI bypass
[attempt 1] suspicious redirection 307 to : ISP page
[attempt 2] suspicious redirection 307 to : ISP page
UNAVAILABLE
- IP block tests (requires manual interpretation)
> testing iana.org on it's original ip
[attempt 1] AVAILABLE
[attempt 2] AVAILABLE
!!!!! AVAILABLE !!!!!
> testing rutracker.org on 192.0.43.8 (iana.org)
[attempt 1] HTTP/1.1 307 Temporary Redirect
Location:
AVAILABLE
[attempt 2] HTTP/1.1 307 Temporary Redirect
Location:
AVAILABLE
> testing iana.org on 104.21.32.39 (rutracker.org)
[attempt 1] HTTP/1.1 409 Conflict
AVAILABLE
[attempt 2] HTTP/1.1 409 Conflict
AVAILABLE
> testing iana.org on 172.67.182.196 (rutracker.org)
[attempt 1] curl: (28) Connection timed out after 2002 milliseconds
[attempt 2] HTTP/1.1 409 Conflict
AVAILABLE
- checking tpws --hostcase
[attempt 1] curl: (7) Failed to connect to 127.0.0.1 port 1993 after 1 ms: Error
[attempt 2] curl: (7) Failed to connect to 127.0.0.1 port 1993 after 1 ms: Error
UNAVAILABLE code=7
- checking tpws --hostspell=hoSt
[attempt 1] curl: (7) Failed to connect to 127.0.0.1 port 1993 after 1 ms: Error
[attempt 2] curl: (7) Failed to connect to 127.0.0.1 port 1993 after 1 ms: Error
UNAVAILABLE code=7
- checking tpws --hostdot
[attempt 1] curl: (7) Failed to connect to 127.0.0.1 port 1993 after 1 ms: Error
[attempt 2] curl: (7) Failed to connect to 127.0.0.1 port 1993 after 1 ms: Error
UNAVAILABLE code=7
- checking tpws --hosttab
[attempt 1] curl: (7) Failed to connect to 127.0.0.1 port 1993 after 1 ms: Error
[attempt 2] curl: (7) Failed to connect to 127.0.0.1 port 1993 after 1 ms: Error
UNAVAILABLE code=7
- checking tpws --hostnospace
[attempt 1] curl: (7) Failed to connect to 127.0.0.1 port 1993 after 1 ms: Error
[attempt 2] curl: (7) Failed to connect to 127.0.0.1 port 1993 after 1 ms: Error
UNAVAILABLE code=7
- checking tpws --domcase
[attempt 1] curl: (7) Failed to connect to 127.0.0.1 port 1993 after 1 ms: Error
[attempt 2] curl: (7) Failed to connect to 127.0.0.1 port 1993 after 1 ms: Error
UNAVAILABLE code=7
....
curl_test_http: tpws strategy for ipv4 rutracker.org not found
preparing nfqws redirection
- checking nfqws --hostcase
[attempt 1] curl: (28) Connection timed out after 2002 milliseconds
[attempt 2] curl: (28) Connection timed out after 2002 milliseconds
UNAVAILABLE code=28
- checking nfqws --hostspell=hoSt
[attempt 1] curl: (28) Connection timed out after 2002 milliseconds
[attempt 2] curl: (28) Connection timed out after 2002 milliseconds
UNAVAILABLE code=28
- checking nfqws --hostnospace
[attempt 1] curl: (28) Connection timed out after 2002 milliseconds
[attempt 2] curl: (28) Connection timed out after 2002 milliseconds
UNAVAILABLE code=28
- checking nfqws --domcase
[attempt 1] curl: (28) Connection timed out after 2002 milliseconds
[attempt 2] curl: (28) Connection timed out after 2002 milliseconds
UNAVAILABLE code=28
- checking nfqws --dpi-desync=split2
[attempt 1] curl: (28) Connection timed out after 2002 milliseconds
[attempt 2] curl: (28) Connection timed out after 2002 milliseconds
UNAVAILABLE code=28
...
config
Debug nfqws (logread check, I did not find any other methods of debug checks in the documentation) (Just typing "nfqws" with debug into the console, like other issues can't do anything and I guess shouldn't)
table inet fw4 before installation Zapret
``` ``` table inet fw4 { chain input { type filter hook input priority filter; policy accept; iifname "lo" accept comment "!fw4: Accept traffic from loopback" ct state established,related accept comment "!fw4: Allow inbound established and related flows" tcp flags syn / fin,syn,rst,ack jump syn_flood comment "!fw4: Rate limit TCP syn packets" iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic" iifname "eth1" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic" }}
I assume that the problem is in the firewall settings, which for some reason are standard for this device in the current versions of openwrt. I will be grateful for constructive thoughts and ideas, because I obviously do not yet have enough qualifications to completely fix the problem.
fw4 stop and nft flush ruleset - does not give any changes in behavior
nft list ruleset after Zapret installation
There is a router with Openwrt installed and standard settings:
network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix '..#..'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
config interface 'wan'
option device 'eth1'
option proto 'dhcp'
config interface 'wan6'
option device 'eth1'
option proto 'dhcpv6'
firewall
Router model - Edgerouter lite
Russian translation
Привет! Есть роутер с чистым openwrt (22.03 и 23.05 v), (я пока не вносил никаких изменений в настройки по умолчанию для проверки проблемы) интернет работает, другие устройства узнают роутер и имеют доступ к интернету через него. Проверка блокировки работает с других устройств, подключенных к этому роутеру. Я изучил readme и другую документацию. После установки необходимых программ, запустили blockcheck.sh Ожидаемое поведение: Отправка пакетов провайдеру для поиска рабочей стратегии Поведение в реальном времени: : После успешной первичной проверки DNS и редиректов на страницу провайдера без обхода DPI, а также ожидаемого результата теста блока IP, происходит ошибка соединения (tpws) к порту 127.0.0.1 1993 и (nfqws) истекло время ожидания соединения. Однако с устройства, подключенного к этому роутеру, проверка блокировки работает успешно. Но при настройке конфига и установке Zapret на роутер ожидаемого результата нет. Интернет ведет себя так, как будто правила не работают. Предполагаю, что проблема в настройках файрвола, которые почему-то являются стандартными для данного устройства в актуальных версиях openwrt. Буду благодарен за конструктивные мысли и идеи, потому что у меня явно пока недостаточно квалификации, чтобы полностью решить проблему. Набор правил FW4 Stop и сброса NFT - не дает никаких изменений в поведенииThank you and Best Regards
Спасибо и с наилучшими пожеланиями