New map.sh file, no more need for firewall.user

[cmspam]

Please see the new map.sh file.

Because I was already making nftables rules with the map.sh file, I thought it was better to integrate everything into one file, so I have integrated the firewall.user script into the map.sh file.

One of the benefits of this, is that it supports both JPNE where each user gets 15 portsets, and OCN where every user gets 63 portsets, and allows you to use all of the portsets.

Once you use this file, you can remove firewall.user and can also remove the lines from /etc/config/firewall that make firewall.user be used.

The additions are lines 163-175
map.sh.txt

[fakemanhk]

Diff of old vs new:

root@OpenWrt:/lib/netifd/proto# mv map.sh.bak map.old
root@OpenWrt:/lib/netifd/proto# 
root@OpenWrt:/lib/netifd/proto# 
root@OpenWrt:/lib/netifd/proto# diff -c map.old map.sh 
*** map.old     Thu Feb 23 15:03:03 2023
--- map.sh      Fri Feb 24 19:57:14 2023
***************
*** 140,145 ****
--- 140,148 ----
              json_add_string snat_ip $(eval "echo \$RULE_${k}_IPV4ADDR")
            json_close_object
          else
+ local mark=10
+ nft add table inet nathack
+ nft add chain inet nathack srcnat {type nat hook postrouting priority 0\; policy accept\; }
            for portset in $(eval "echo \$RULE_${k}_PORTSETS"); do
                for proto in icmp tcp udp; do
                json_add_object ""
***************
*** 147,158 ****
--- 150,177 ----
                  json_add_string target SNAT
                  json_add_string family inet
                  json_add_string proto "$proto"
+                 json_add_string mark "$mark/0x0000ff"
                    json_add_boolean connlimit_ports 1
                    json_add_string snat_ip $(eval "echo \$RULE_${k}_IPV4ADDR")
                    json_add_string snat_port "$portset"
                json_close_object
                done
+             nft add rule inet nathack srcnat meta nfproto ipv4 meta l4proto icmp oifname "map-$cfg" meta mark and 0x0000ff ==  $mark counter packets 0 bytes 0 snat ip to $(eval "echo \$RULE_${k}_IPV4ADDR"):$portset
+ 
+             mark=`expr $mark + 1`
            done
+ nft add table ip nathack
+ nft add chain ip nathack PREROUTING { type filter hook prerouting priority 0 \; }
+ nft add chain ip nathack OUTPUT { type filter hook output priority 0 \; }
+ local mcount=0
+ local max=`expr $mark - 10`
+ mark=10
+               for portset in $(eval "echo \$RULE_${k}_PORTSETS"); do
+                       nft add rule ip nathack PREROUTING numgen inc mod $max $mcount counter meta mark set meta mark and 0xffffff00 or $mark
+                       nft add rule ip nathack OUTPUT numgen inc mod $max $mcount counter meta mark set meta mark and 0xffffff00 or $mark
+                       mark=`expr $mark + 1`
+                       mcount=`expr $mcount + 1`
+               done
          fi
          if [ "$maptype" = "map-t" ]; then
                [ -z "$zone" ] && zone=$(fw3 -q network $iface 2>/dev/null)

I can confirm this is working, firewall status indicating that more port groups are being used now.

[fakemanhk]

Quick question, have you tried to run VPN client on router with this new setup?
I am using PIA VPN and I find that once the router connected to my service provider (a TUN interface with IP comes up) and then even the router itself can't access anything.

[cmspam]

I just tried setting up a wireguard vpn client, and it worked.

Is your openvpn?

If it's not working, can you please paste your nftables ruleset?

Also, maybe check the MTU of your VPN. Set it to 1280 and try from there.

[cmspam]

Update, I also tried OpenVPN, and it worked.
Maybe you didn't configure the TUN interface in the firewall? If the tun is tun0, try in LuCi:
Network -> Interfaces, Add new interface
(A name you like), unmanaged, tun0 (you have to manually write this maybe)

Then put it in the WAN firewall zone or as appropriate.

[fakemanhk]

OK I understand why now, the way I put it in WAN zone in 19.07 (exactly the same as step 4.1-b of this guide) doesn't work on 22.03, so you also use "Use default gateway" to control whether by default to use the VPN route or not?

[TimOfAllTrades]

Speaking of VPN, I am also having an issue.
My current setup
ONU - > switch. A Tplink (192.168.1.100) and nanopi 4s (192.168.1.1) are connected to this switch.

Nanopi 4s LAN - > LAN3 on the TPlink
Desktop on Tplink LAN2.

Nanopi 4s is the Dhcp server. Tplink is static.

OPENVPN server installed on both Nanopi and tplink.

When I connect to the nanopi (dhcp) ovpn server I can access my entire LAN, but when I VPN connect to the tplink, I can't access anything.

I am guessing the issue is that my LAN has the nanopi dhcp server as it's gateway, so the nanopi VPN can reach it. But that isn't the case for the tplink. Any idea how I can make it so that a VPN connection to either router can access my Lan?

[fakemanhk]

I am guessing the issue is that my LAN has the nanopi dhcp server as it's gateway, so the nanopi VPN can reach it. But that isn't the case for the tplink. Any idea how I can make it so that a VPN connection to either router can access my Lan?

Since I don't know how you set this up so it's difficult to troubleshoot.
But your guess about gateway should be correct, and there should be some special routes needed for your LAN machines in order to respond to the tunnel where packets coming from.

[TimOfAllTrades]

Hey sup guys. Just wanna say great work is being done here. The instructions have solved most of the issues I have been going through.

[fakemanhk]

I just figured out that because mwan3 package doesn't work with fw4 (still using iptables-nft), which could mess up with this setup, now even I removed the package I am still getting some issues, might need to re-do the whole thing again.

[cmspam]

What issues are you getting?
mwan3 generally does work with fw4, by using iptables-nft.
I don't think the script would have added any legacy iptables rules...