Проблема с nftables на OpenWrt.
Форум — Admin
Суть такая, что правило
nft add rule ip filter forward oif wg0 tcp flags syn tcp option maxseg size set rt mtuПишет
root@OpenWrt:~# nft -f /etc/nftables_0.conf
/etc/nftables_0.conf:9:17-73: Error: Could not process rule: No such file or directory
oif "wg0" tcp flags syn tcp option maxseg size set rt mtu;
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/etc/nftables_0.conf
flush ruleset
table inet filter {
chain input{
type filter hook input priority 0; policy accept;
}
chain forward {
type filter hook forward priority 0;
oif "wg0" tcp flags syn tcp option maxseg size set rt mtu;
}
chain output {
type filter hook output priority 0; policy accept;
}
}
root@OpenWrt:~# nft --version
nftables v0.9.0 (Fearless Fosdick)
root@OpenWrt:~# uname -a
Linux OpenWrt 4.14.63 #0 Wed Aug 15 20:42:39 2018 mips GNU/Linux
root@OpenWrt:~# cat /etc/openwrt_release
DISTRIB_ID='OpenWrt'
DISTRIB_RELEASE='18.06.1'
DISTRIB_REVISION='r7258-5eb055306f'
DISTRIB_TARGET='ramips/rt3883'
DISTRIB_ARCH='mipsel_74kc'
DISTRIB_DESCRIPTION='OpenWrt 18.06.1 r7258-5eb055306f'
DISTRIB_TAINTS=''
root@OpenWrt:~# lsmod | grep ^nf
nf_conntrack 55488 40 nft_redir_ipv6,nft_redir_ipv4,nft_redir,nft_nat,nft_masq_ipv6,nft_masq_ipv4,nft_masq,nft_flow_offload,nft_ct,nf_nat_pptp,nf_conntrack_pptp,nf_conntrack_netlink,xt_state,xt_conntrack,xt_CT,nf_nat_tftp,nf_nat_snmp_basic,nf_nat_sip,nf_nat_masquerade_ipv6,nf_nat_masquerade_ipv4,nf_nat_irc,nf_conntrack_ipv6,nf_nat_ipv6,nf_conntrack_ipv4,nf_nat_ipv4,nf_nat_h323,nf_nat_ftp,nf_nat_amanda,nf_nat,nf_flow_table,nf_conntrack_tftp,nf_conntrack_snmp,nf_conntrack_sip,nf_conntrack_rtcache,nf_conntrack_proto_gre,nf_conntrack_irc,nf_conntrack_h323,nf_conntrack_ftp,nf_conntrack_broadcast,nf_conntrack_amanda
nf_conntrack_amanda 1696 1 nf_nat_amanda
nf_conntrack_broadcast 768 1 nf_conntrack_snmp
nf_conntrack_ftp 5152 1 nf_nat_ftp
nf_conntrack_h323 34368 1 nf_nat_h323
nf_conntrack_ipv4 4928 5
nf_conntrack_ipv6 5040 5
nf_conntrack_irc 2864 1 nf_nat_irc
nf_conntrack_netlink 20896 0
nf_conntrack_pptp 3456 1 nf_nat_pptp
nf_conntrack_proto_gre 2464 1 nf_conntrack_pptp
nf_conntrack_rtcache 2432 0
nf_conntrack_sip 17632 1 nf_nat_sip
nf_conntrack_snmp 720 1 nf_nat_snmp_basic
nf_conntrack_tftp 2752 1 nf_nat_tftp
nf_defrag_ipv4 1024 1 nf_conntrack_ipv4
nf_defrag_ipv6 8944 1 nf_conntrack_ipv6
nf_flow_table 12176 5 nf_flow_table_ipv6,nf_flow_table_ipv4,nf_flow_table_inet,nft_flow_offload,nf_flow_table_hw
nf_flow_table_hw 1984 0
nf_flow_table_inet 416 0
nf_flow_table_ipv4 384 0
nf_flow_table_ipv6 384 0
nf_log_common 2624 1 nf_log_ipv4
nf_log_ipv4 3232 0
nf_nat 9360 14 nft_nat,nf_nat_pptp,nf_nat_tftp,nf_nat_sip,nf_nat_redirect,nf_nat_proto_gre,nf_nat_masquerade_ipv6,nf_nat_masquerade_ipv4,nf_nat_irc,nf_nat_ipv6,nf_nat_ipv4,nf_nat_h323,nf_nat_ftp,nf_nat_amanda
nf_nat_amanda 736 0
nf_nat_ftp 1184 0
nf_nat_h323 5024 0
nf_nat_ipv4 3760 1 nft_chain_nat_ipv4
nf_nat_ipv6 4432 1 nft_chain_nat_ipv6
nf_nat_irc 992 0
nf_nat_masquerade_ipv4 1392 1 nft_masq_ipv4
nf_nat_masquerade_ipv6 1552 1 nft_masq_ipv6
nf_nat_pptp 1664 0
nf_nat_proto_gre 816 1 nf_nat_pptp
nf_nat_redirect 1088 2 nft_redir_ipv6,nft_redir_ipv4
nf_nat_sip 7168 0
nf_nat_snmp_basic 6320 0
nf_nat_tftp 512 0
nf_reject_ipv4 2048 4 nft_reject_ipv4,nft_reject_inet,nft_reject_bridge,ipt_REJECT
nf_reject_ipv6 2464 3 nft_reject_ipv6,nft_reject_inet,nft_reject_bridge
nf_tables 64912137 nf_flow_table_ipv6,nf_flow_table_ipv4,nf_flow_table_inet,nft_set_rbtree,nft_set_hash,nft_reject_ipv6,nft_reject_ipv4,nft_reject_inet,nft_reject_bridge,nft_reject,nft_redir_ipv6,nft_redir_ipv4,nft_redir,nft_quota,nft_numgen,nft_nat,nft_meta_bridge,nft_meta,nft_masq_ipv6,nft_masq_ipv4,nft_masq,nft_log,nft_limit,nft_flow_offload,nft_exthdr,nft_ct,nft_counter,nft_chain_route_ipv6,nft_chain_route_ipv4,nft_chain_nat_ipv6,nft_chain_nat_ipv4,nf_tables_ipv6,nf_tables_ipv4,nf_tables_inet,nf_tables_bridge,nf_tables_arp
nf_tables_arp 480 0
nf_tables_bridge 992 0
nf_tables_inet 640 0
nf_tables_ipv4 544 3
nf_tables_ipv6 576 3
nfnetlink 3936 2 nf_tables,nf_conntrack_netlink
nft_chain_nat_ipv4 576 0
nft_chain_nat_ipv6 608 0
nft_chain_route_ipv4 736 0
nft_chain_route_ipv6 864 0
nft_counter 1696 1
nft_ct 5376 8
nft_exthdr 3168 2
nft_flow_offload 1440 0
nft_limit 3392 0
nft_log 1504 0
nft_masq 928 2 nft_masq_ipv6,nft_masq_ipv4
nft_masq_ipv4 672 0
nft_masq_ipv6 672 0
nft_meta 3664 19 nft_meta_bridge
nft_meta_bridge 864 0
nft_nat 1824 0
nft_numgen 1616 0
nft_quota 1696 0
nft_redir 928 2 nft_redir_ipv6,nft_redir_ipv4
nft_redir_ipv4 608 0
nft_redir_ipv6 672 0
nft_reject 864 4 nft_reject_ipv6,nft_reject_ipv4,nft_reject_inet,nft_reject_bridge
nft_reject_bridge 3872 0
nft_reject_inet 1056 0
nft_reject_ipv4 576 0
nft_reject_ipv6 576 0
nft_set_hash 13056 11
nft_set_rbtree 2336 0