[Cerowrt-devel] upgrading from CeroWRT --- seeking advice on rule testing
dave.taht at gmail.com
Mon Feb 11 13:48:42 EST 2019
On Sun, Feb 10, 2019 at 2:34 PM Michael Richardson <mcr at sandelman.ca> wrote:
> Dave Taht <dave at taht.net> wrote:
> >> systems having DualStack with NAT44.
> > I'm under the impression various ipv6 -> ipv4 nat tools are working much
> > better now. I can't bring myself to care much about ipv6 until I too can
> > get a static IPv6 allocation. I'm so fed up with the deployment that
> > I've been working on adding ips to ipv4....
> Well, you can get a static IPv6 allocation for a fee, you just need an ISP that
> you can speak BGP to. That's really what your issue is more than the allocation.
Comcast is my only choice.
> >> The naming "se00" vs "ethXX" gets in the way. I have weird problems
> >> where
> >> machines behind the gateway can ping 188.8.131.52, but I can't ping it from
> >> the
> >> gateway. The details don't matter. I'm mostly writing this for future
> >> people
> >> googling. I spent another two hours today trying to debug (the first
> >> time, I
> >> had no working uplink, and I was missing tcpdump on the new unit. I
> >> was
> >> convinced my ISP had dropped my static routes)...
> >> So I will be starting again from scratch (total factory reset), get it
> >> going, and then add my custom configuration.
> > I generally prototype by having a second router entirely take over the
> > functions of the network. Much like you added a pure wifi router, in
> > your case I'd have got another router entirely, flashed openwrt, and
> > tried to get each feature you needed working that way.
> The problem with trying to make it all work in a test bench is that
> it has to work with the v6 prefixes that matter, and those are in use.
> So I guess I could put two routes in series and move things over VLAN by
> VLAN. I have the untagged traffic out of the router go into VLAN3800
> on the switch, which I can see from my desktop. At least the replacement
> router has a serial console, which I never added to the original.
> > I do wish cerowrt's stateless firewall idea had been adopted by openwrt,
> > it leads to much less complicated rules to just pattern match for s+,
> > g+, etc.
> Hmm. I am not sure I understand your point.
> It all looks the same to me, but perhaps I'm running into this differences
> under the hood which is screwing me up.
>From early benchmarks, doing more and more complicated firewall
configurations, was far more efficient
when I was using the pattern match syntax. Otherwise openwrt needs one
rule per interface to launch it down the ipchains.
"+" is iptables pattern match character.
In cerowrt all you had to do was establish your "zones" and add a new
interface to a zone, by renaming the interface appropriately. You
never needed to reload the firewall rules once established. openwrt
holds the concept of zone entirely seperately. I forget how many rules
this saved (but it was a lot) in cerowrt's fully routed design.
https://www.bufferbloat.net/projects/cerowrt/wiki/CeroWall/ has all
the doc on it I ever wrote... the actual implementation worked for a
lot of people.
I have no idea how much more efficient nft is.
> ] Never tell me the odds! | ipv6 mesh networks [
> ] Michael Richardson, Sandelman Software Works | IoT architect [
> ] mcr at sandelman.ca http://www.sandelman.ca/ | ruby on rails [
> Cerowrt-devel mailing list
> Cerowrt-devel at lists.bufferbloat.net
CTO, TekLibre, LLC
More information about the Cerowrt-devel