Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

FS#806 - Does not equal iptables rule not working #6595

Closed
openwrt-bot opened this issue May 25, 2017 · 2 comments
Closed

FS#806 - Does not equal iptables rule not working #6595

openwrt-bot opened this issue May 25, 2017 · 2 comments
Labels

Comments

@openwrt-bot
Copy link

@openwrt-bot openwrt-bot commented May 25, 2017

lleachii:

The following was entered in LuCI and confirmed by looking at /etc/config/firewall:

config rule option enabled '1' option family 'ipv4' option proto 'all' option src '*' option src_ip '! 192.168.1.0/24' option target 'DROP' option name 'Drop_OUT_InvalidSRC' option dest '*' option extra '-o eth0.2'

I've also made the rule without option extra, and by specifying the dest WAN. The rule never appears on my firewall; but adding it via the Custom Firewall rule is works.

@openwrt-bot
Copy link
Author

@openwrt-bot openwrt-bot commented May 26, 2017

jow-:

There's two issues preventing your rule to work with the current firewall implementation.

  1. "option extra" has no support for "-i", "-o", "-s" or "-d".

So far, only match specific options were allowed in "option extra" which causes your
rule to get rejected with "Bad argument" during parsing.

A workaround is to use "option dest wan" instead.

Support for "-i", "-o", "-s" and "-d" has now been added to upstream firewall3.git with http://git.lede-project.org/0e5dd73

  1. "option src_ip" must have no space between the "!" and the IP address.

Since "option src_ip" is parsed as space separated list for "config rule" sections,
your "option src_ip '! 192.168.1.0/24'" is interpreted as list src_ip '!'
list src_ip '192.168.1.0/24'
which leads to an error like Warning: Option @rule[0].src_ip has invalid value '!'

A workaround is to remove the space between the exclamation mark and the address.

A fix for this parsing behavior has been added to upstream firewall3.git with http://git.lede-project.org/3d2c18a

@openwrt-bot
Copy link
Author

@openwrt-bot openwrt-bot commented May 29, 2017

lleachii:

Jo-Philipp,

The work around (removing the space) places the rule on my iptables!

It seems to hit all packets, but calls the thats WAN's drop chain. I see zero drops, which is expected (since I have a Custom RAW table rule dropping incoming from the LAN bridge also not equaling the SRC address).

I will test the space parsing in the next release.

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant