fw4 generates incorrect NAT leakage rule (ct state invalid instead of new) in accept_to_wan
Nobody has claimed this yet.
- Dominant language
- ucode
- Stars
- 27
- Forks
- 37
- PR merge metrics
- No merged PRs in 30d
Description
OpenWrt Version: 24.10.1 (r28597-0425664679)
firewall4 Version: 2024.12.18~18fc0ead-r1
Target: x86_64
Observed behavior:
The default fw4 ruleset in accept_to_wan contains:
meta nfproto ipv4 oifname "eth1" ct state invalid drop comment "!fw4: Prevent NAT leakage"
However, this rule does not drop new outgoing connections that leak private IPs when masquerading is missing.
Expected behavior:
It should insert the following rule instead:
meta nfproto ipv4 oifname "eth1" ct state new drop comment "!fw4: Prevent NAT leakage"
Workaround:
Manually inserting the above ct state new drop rule into the accept_to_wan chain solves the problem and correctly drops un-NATed new traffic.
Please confirm whether this is a regression or a logic oversight in rule generation.
Thank you!
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Use the accept_to_wan chain and the reported default ruleset as entry points; trace where the NAT leakage rule is generated and verify the conntrack state used there. Reproduce with OpenWrt 24.10.1 and firewall4 2024.12.18, then add or update focused coverage if the repository provides it. Done means un-NATed new traffic is dropped by the generated rule.
Written by the indexing model from the issue text.
Assessment
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100