openwrt / openwrt/firewall4

MAC address ipsets should not be limited to a single family

Open
#45 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
ucode
Stars
27
Forks
37
PR merge metrics
No merged PRs in 30d

Description

If I have an ipset:

config ipset
	list match 'src_mac'
…

it seems that I cannot have multiple (i.e. any) family for it. Instead I need to maintain two duplicate ipsets each with option family 'ipv4' and option family 'ipv6' to be able to use in rules such as:

config rule
	option name 'FFA hosts can use the Internet'
	option ipset 'FFA-to-Internet_v4'
	option src 'lan'
	option dest 'wan'
	option target 'ACCEPT'
	option family 'any'
	list proto 'all'

config rule
	option name 'FFA hosts can use the Internet'
	option ipset 'FFA-to-Internet_v6'
	option src 'lan'
	option dest 'wan'
	option target 'ACCEPT'
	option family 'any'
	list proto 'all'

in order to produce the following two NFT rules:

                meta nfproto 2 ether saddr @FFA-to-Internet_v4 counter packets 65 bytes 6038 jump accept_to_wan comment "!fw4: FFA hosts can use the Internet" # handle 20166
                meta nfproto 10 ether saddr @FFA-to-Internet_v6 counter packets 207 bytes 24765 jump accept_to_wan comment "!fw4: FFA hosts can use the Internet" # handle 20167

NFT allows the above to be in a single rule:

                meta nfproto { 2, 10 } ether saddr @FFA-to-Internet_v4 counter packets 2188 bytes 194437 jump accept_to_wan # handle 20362

added manually with:

# nft add rule inet fw4 forward_lan position 20165 meta nfproto { ipv4, ipv6 } ether saddr @FFA-to-Internet_v4 counter packets 2149 bytes 190394 jump accept_to_wan

Could this family restriction on MAC based ipsets be lifted so that we don't have so much duplication and duplicated maintenance in the firewall config?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing how the ipset family option is handled for src_mac sets and how the shown nft rules are generated. Use the issue's single-rule nft example as the expected result, and verify that one MAC-based ipset can cover both IPv4 and IPv6 without duplicated firewall configuration.

Written by the indexing model from the issue text.

Assessment

Domain
networking
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.