New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Android networking (except for DNS) does not work with nftables, but works with iptables #105
Comments
How are you changing this? Or is this before compiling? I can't get network access at all. Would something like this work? |
Not compiling, i installed it from the AUR and manually edited the |
Okay cool thanks. Will give it a shot. |
Btw, found this on the postmarketOS wiki
Have not tried it yet, so not sure if this is PMOS specific |
Inside the waydroid shell you csn run |
Sadly nothing is seeming to work. Will put it on pause till I have another block of time. I probably need to work on my container knowledge, which would be helpful on this and another future project. |
Also having this issue on PMOS edge. |
22f671b |
I tried this manually changing this config, but still not working. Should I remove and reinstall everything, @erfanoabdi ? And if so, what is the best way to uninstall? There are pieces all over the place. |
not needed to uninstall |
To make internet on WayDroid working with nftables, an nftables rule in
|
I add the snippet above to /etc/nftables.conf, restarted nftables.service but nothing happened. Waydroid still not has connetcion. And if I change LXC_USE_NFT to false, the session doesnt start at all. waydroid log says that "failed to attach "vethxxxxxx" to bridge "waydroid0", bridge interface doesn't exists Distro: Manjaro ARM on Pinephone |
If you add it to
That happens for me too, because it falls back to |
thanks for the rule |
for some reaseon, andoid in the container doesnt pick up a gateway... |
Tried this too?
|
Clear, it works. But it is an ugly workaround, moreover -- not persistent. Restarting android within the container could (will?) break the setting. The gateway should be picked up automatically -- why this is not the case is a magic. Because with iptables seems to work. With nft -- no. Meanwhile both filtering rules (iptables and nft) seem to be absolutely indentical. |
i tried by changing the nftables but nothing seems to work, if someone can help me pls im on arch (btw) basically the wifi turn on and automatically back off pls send help |
These rules seem a bit loose to me. For context, here is how libvirt does network filtering. To translate to nft term it is something like this (libvirt NAT mode):
I haven't tested these rules for waydroid though. Also, I don't think Alpine should ship firewall rules for waydroid. It should be provided upstream (here) or manually configured by the users to their liking. |
waydroid/data/scripts/waydroid-net.sh Lines 93 to 99 in eebdcec
This is a bit of a rant, but the NAT firewall rule here is dangerous. Usually when you assign IPv6 for a bridge, shouldn't it use prefix delegation (so the bridge is like a subnet of the previous subnet)? AFAIK IPv6 source nat doesn't exist. |
I'm troubleshooting a problem that may be related, not getting internet after a clean delete/init of waydroid. I checked that nftables is disabled, but I notice that my iptables is completely blank, is this expected?
|
on Fedora 36 does this show |
On Arch this seems to be fixed now with a fresh install, try deleting all the folders, re-initializing and upgrading waydroid.
It's overkill to upgrade right after a fresh init, but it double checks you've got the latest. |
When running this with or without nft, it gives |
It could be, that the waydroid container gets different address. go into it and see how the routing table and addresses look out: waydroid shell ip r Ahm. In android would be route and then you should place an address of yout host adapter in place of 192.168.250.1 in the command below. It could be some 192.168.100.1 or something like this. |
Found mine "192.168.240.1" no errors on script but no wifi either |
same here except getting still getting errors on the script :( |
I tried this on Fedora, now whenever I do Even when I revert it back to Reinstalling fixed it tho... |
I think there also is a problem with systemd-resolved. OpenSnitch only doesnt break it btw. |
I actually had the same error message as @vrmaurice (so could be something else but hey) on postmarketOS edge recently, after trying a few things with the script individually it eventually occurred to me that strangely enough |
When running with the nftables networking, I saw in
waydroid logcat
that hosts were being resolved, but http/https connections were not connecting.Switching
LXC_USE_NFT
to"false"
in waydroid-net.sh fixed networking for me.The text was updated successfully, but these errors were encountered: