From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-qt1-x82b.google.com (mail-qt1-x82b.google.com [IPv6:2607:f8b0:4864:20::82b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by lists.bufferbloat.net (Postfix) with ESMTPS id 2CF963B2A4 for ; Mon, 11 Feb 2019 13:48:55 -0500 (EST) Received: by mail-qt1-x82b.google.com with SMTP id y20so13351807qtm.13 for ; Mon, 11 Feb 2019 10:48:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=jY01jzchgFkMyChGDxF+95e8cTF1bSE2ifBWxr5hW+A=; b=e0+d2mmNq6kP3TmuV2KiqEnljf51pE569DdXHpRY96zfXP5YgO+urYOz9030UVSOXU Y2JwOIZdTVr0QOojVpsHc43qb5Hl/8au0q0kPXT/X8Ucd9SYGXM54KfrDBwvVefKk8xO iUUIZTq3d332dg6eRN/fTKU8WX7SeadJJQ6nlRBc2LW5RIl04TDO84wzHEgh7hOn6whL qRnJ7hdMrdLxMfO4c1d1p2CzCO6sYbTpEIf7AOowVjAQRRI+K8+KUtSk//iR+MUhFNTd gJdhZL2wQPLVeG4FcbCvRnJ8cg3tCZBEgnAi++irL0OK+nVk+4ALoC72tt6AD0YHu+V5 iwnA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=jY01jzchgFkMyChGDxF+95e8cTF1bSE2ifBWxr5hW+A=; b=RXfH3PGYfQYH6HLFed8kPJjYMFHoKFdu9oRUDabRMCzsxH6fykfX8jLWaH3BeI8MvQ 6VOrlOqAHyDg4DJFpVZ9EkF+jYz6PdXoPbaT7obTwr+CDFrehwM79E6Vgip8GJXd1JMA EdRcho2qPFu4POLLjYkryO+D8aMaGybp0YgKIwX5uvsLOERxCfg6b1/8XBgWovtslYZI gBUZg5uaIoeS/RHgdzQEtDGQozqkzVwSw+8ei/ZTLkZQi0sN4ql7oebAZ/jNcTH+a54e f0Zt9yTXXG73hDmI9CvSSxqss997KnzDRMswqpTb9x/MqDLeksnnG4m22bd5z0rVW1+I 9qMw== X-Gm-Message-State: AHQUAubKYRq7CExfPrOPws5q3ui6wh1jEiNOWsKG27nHO2rJ65kC4Lbo N8Ld+C+76MMTIM0XNSGXwyF4Tq8mFO448ZMFGoo= X-Google-Smtp-Source: AHgI3IYIMqd/joGyjcHQiTpOQStS8PcBESaUamlFeZqWD19f4h4017xeI265Ex0JZRmgE0RLhWZaliNFD2kANfiTy9k= X-Received: by 2002:ac8:3f46:: with SMTP id w6mr5067422qtk.175.1549910934669; Mon, 11 Feb 2019 10:48:54 -0800 (PST) MIME-Version: 1.0 References: <7437.1549566518@dooku.sandelman.ca> <87mun4yilz.fsf@taht.net> <11926.1549838089@localhost> In-Reply-To: <11926.1549838089@localhost> From: Dave Taht Date: Mon, 11 Feb 2019 10:48:42 -0800 Message-ID: To: Michael Richardson Cc: Dave Taht , cerowrt-devel Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Subject: Re: [Cerowrt-devel] upgrading from CeroWRT --- seeking advice on rule testing X-BeenThere: cerowrt-devel@lists.bufferbloat.net X-Mailman-Version: 2.1.20 Precedence: list List-Id: Development issues regarding the cerowrt test router project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Feb 2019 18:48:55 -0000 On Sun, Feb 10, 2019 at 2:34 PM Michael Richardson wrote= : > > > Dave Taht wrote: > >> systems having DualStack with NAT44. > > > I'm under the impression various ipv6 -> ipv4 nat tools are working= much > > better now. I can't bring myself to care much about ipv6 until I to= o can > > get a static IPv6 allocation. I'm so fed up with the deployment tha= t > > I've been working on adding ips to ipv4.... > > Well, you can get a static IPv6 allocation for a fee, you just need an IS= P that > you can speak BGP to. That's really what your issue is more than the all= ocation. Comcast is my only choice. > >> The naming "se00" vs "ethXX" gets in the way. I have weird proble= ms > >> where > >> machines behind the gateway can ping 8.8.8.8, but I can't ping it = from > >> the > >> gateway. The details don't matter. I'm mostly writing this for fu= ture > >> people > >> googling. I spent another two hours today trying to debug (the fir= st > >> time, I > >> had no working uplink, and I was missing tcpdump on the new unit. = I > >> was > >> convinced my ISP had dropped my static routes)... > >> > >> So I will be starting again from scratch (total factory reset), ge= t it > >> going, and then add my custom configuration. > > > I generally prototype by having a second router entirely take over = the > > functions of the network. Much like you added a pure wifi router, i= n > > your case I'd have got another router entirely, flashed openwrt, an= d > > tried to get each feature you needed working that way. > > The problem with trying to make it all work in a test bench is that > it has to work with the v6 prefixes that matter, and those are in use. > So I guess I could put two routes in series and move things over VLAN by > VLAN. I have the untagged traffic out of the router go into VLAN3800 > on the switch, which I can see from my desktop. At least the replacement > router has a serial console, which I never added to the original. > > > I do wish cerowrt's stateless firewall idea had been adopted by ope= nwrt, > > it leads to much less complicated rules to just pattern match for s= +, > > g+, etc. > > Hmm. I am not sure I understand your point. > It all looks the same to me, but perhaps I'm running into this difference= s > under the hood which is screwing me up. >From early benchmarks, doing more and more complicated firewall configurations, was far more efficient when I was using the pattern match syntax. Otherwise openwrt needs one rule per interface to launch it down the ipchains. "+" is iptables pattern match character. In cerowrt all you had to do was establish your "zones" and add a new interface to a zone, by renaming the interface appropriately. You never needed to reload the firewall rules once established. openwrt holds the concept of zone entirely seperately. I forget how many rules this saved (but it was a lot) in cerowrt's fully routed design. https://www.bufferbloat.net/projects/cerowrt/wiki/CeroWall/ has all the doc on it I ever wrote... the actual implementation worked for a lot of people. I have no idea how much more efficient nft is. > > -- > ] Never tell me the odds! | ipv6 mesh netwo= rks [ > ] Michael Richardson, Sandelman Software Works | IoT architec= t [ > ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails= [ > > > > > _______________________________________________ > Cerowrt-devel mailing list > Cerowrt-devel@lists.bufferbloat.net > https://lists.bufferbloat.net/listinfo/cerowrt-devel --=20 Dave T=C3=A4ht CTO, TekLibre, LLC http://www.teklibre.com Tel: 1-831-205-9740