Re: [Cerowrt-devel] upgrading from CeroWRT --- seeking advice on rule testing

[Dave Taht <dave.taht@gmail.com>]

On Sun, Feb 10, 2019 at 2:34 PM Michael Richardson <mcr@sandelman.ca> wrote:
>
>
> Dave Taht <dave@taht.net> wrote:
>     >> systems having DualStack with NAT44.
>
>     > I'm under the impression various ipv6 -> ipv4 nat tools are working much
>     > better now. I can't bring myself to care much about ipv6 until I too can
>     > get a static IPv6 allocation. I'm so fed up with the deployment that
>     > I've been working on adding ips to ipv4....
>
> Well, you can get a static IPv6 allocation for a fee, you just need an ISP that
> you can speak BGP to.  That's really what your issue is more than the allocation.

Comcast is my only choice.

>     >> The naming "se00" vs "ethXX" gets in the way.  I have weird problems
>     >> where
>     >> machines behind the gateway can ping 8.8.8.8, but I can't ping it from
>     >> the
>     >> gateway.  The details don't matter. I'm mostly writing this for future
>     >> people
>     >> googling. I spent another two hours today trying to debug (the first
>     >> time, I
>     >> had no working uplink, and I was missing tcpdump on the new unit. I
>     >> was
>     >> convinced my ISP had dropped my static routes)...
>     >>
>     >> So I will be starting again from scratch (total factory reset), get it
>     >> going, and then add my custom configuration.
>
>     > I generally prototype by having a second router entirely take over the
>     > functions of the network. Much like you added a pure wifi router, in
>     > your case I'd have got another router entirely, flashed openwrt, and
>     > tried to get each feature you needed working that way.
>
> The problem with trying to make it all work in a test bench is that
> it has to work with the v6 prefixes that matter, and those are in use.
> So I guess I could put two routes in series and move things over VLAN by
> VLAN.  I have the untagged traffic out of the router go into VLAN3800
> on the switch, which I can see from my desktop.  At least the replacement
> router has a serial console, which I never added to the original.
>
>     > I do wish cerowrt's stateless firewall idea had been adopted by openwrt,
>     > it leads to much less complicated rules to just pattern match for s+,
>     > g+, etc.
>
> Hmm. I am not sure I understand your point.
> It all looks the same to me, but perhaps I'm running into this differences
> under the hood which is screwing me up.

From early benchmarks, doing more and more complicated firewall
configurations, was far more efficient
when I was using the pattern match syntax. Otherwise openwrt needs one
rule per interface to launch it down the ipchains.
"+" is iptables pattern match character.

In cerowrt all you had to do was establish your "zones" and add a new
interface to a zone, by renaming the interface appropriately. You
never needed to reload the firewall rules once established. openwrt
holds the concept of zone entirely seperately. I forget how many rules
this saved (but it was a lot) in cerowrt's fully routed design.
https://www.bufferbloat.net/projects/cerowrt/wiki/CeroWall/ has all
the doc on it I ever wrote... the actual implementation worked for a
lot of people.

I have no idea how much more efficient nft is.

>
> --
> ]               Never tell me the odds!                 | ipv6 mesh networks [
> ]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
> ]     mcr@sandelman.ca  http://www.sandelman.ca/        |   ruby on rails    [
>
>
>
>
> _______________________________________________
> Cerowrt-devel mailing list
> Cerowrt-devel@lists.bufferbloat.net
> https://lists.bufferbloat.net/listinfo/cerowrt-devel



-- 

Dave Täht
CTO, TekLibre, LLC
http://www.teklibre.com
Tel: 1-831-205-9740