From b870c743c7ad651902003abd946f8b16268b6e74 Mon Sep 17 00:00:00 2001 From: Luke Craig Date: Sat, 25 Jul 2026 00:23:53 -0400 Subject: [PATCH] configs: enable netfilter targets/matches OEM firewall scripts need Rehosted router firmware regenerates its whole ruleset from nvram and loads it with `iptables-restore`. iptables resolves match/target names kernel-side at COMMIT, and restore is atomic per table, so a single unknown target discards the entire table and aborts the remaining ones - the guest ends up with no firewall at all. Seen on the RV130 (armel/4.10): /sbin/rc writes /tmp/.ipt, then iptables-restore: line 52 failed <- COMMIT of *mangle iptables: No chain/target/match by that name ip6tables-restore: line 22 failed Line 52 is the *mangle COMMIT; the first substantive rules in that table are `-j LOG --log-prefix "URL Filter "/"ACL Allow "/"ACL Drop "`. xt_LOG was not built in (only the nf_log core, via NFLOG), and the guest cannot load modules, so nothing could rescue it. Counting rule fragments in that firmware's /sbin/rc, the targets it emits are ACCEPT, DROP, MARK, LOG, DNAT, DSCP, RETURN, TRIGGER, SNAT, REJECT, QUEUE, IPS, CONNMARK, LED, TCPMSS, and the matches are state, tcp, limit, udp, mark, iprange, webstr, physdev, mac, ipv6header, tunnel, tcpmss, dscp, 6to6. Everything in-tree that was missing is enabled here for both 4.10 and 6.13: - xt_LOG (+ NF_LOG_IPV4/IPV6, pulled in by select) - DSCP/TOS target and dscp/tos match - LED target, plus the LEDS_CLASS/LEDS_TRIGGERS/NEW_LEDS it depends on (XT_TARGET_LED was already listed for 6.13 but silently dropped, since no LED class was enabled) - ip6tables ah/eui64/frag/hl/ipv6header/mh/hbh-dst/rt matches - conntrack+NAT helpers for H.323, IRC, PPTP (with GRE) and SIP, which the device kernel has and which router NAT paths expect Still unavailable, and out of scope for a config change: TRIGGER, IPS, webstr, tunnel and 6to6 are out-of-tree Broadcom/vendor modules, and the legacy QUEUE target and ULOG were removed upstream long ago (NFQUEUE and NFLOG are the replacements, both already enabled). Verified by building 4.10/armel: the resulting .config has CONFIG_NETFILTER_XT_TARGET_LOG=y, NF_LOG_IPV4/IPV6=y, XT_TARGET_DSCP, XT_MATCH_DSCP, the IP6_NF_MATCH_* set and NF_NAT_{SIP,IRC,PPTP,H323}. `--config-only` lint is clean for both versions. --- configs/4.10/all-common.inc | 19 +++++++++++++++++++ configs/6.13/all-common.inc | 19 +++++++++++++++++++ 2 files changed, 38 insertions(+) diff --git a/configs/4.10/all-common.inc b/configs/4.10/all-common.inc index a6b327b..3d4b85b 100644 --- a/configs/4.10/all-common.inc +++ b/configs/4.10/all-common.inc @@ -96,6 +96,14 @@ CONFIG_INPUT_EVDEV=y CONFIG_IP6_NF_FILTER=y CONFIG_IP6_NF_IPTABLES=y CONFIG_IP6_NF_MANGLE=y +CONFIG_IP6_NF_MATCH_AH=y +CONFIG_IP6_NF_MATCH_EUI64=y +CONFIG_IP6_NF_MATCH_FRAG=y +CONFIG_IP6_NF_MATCH_HL=y +CONFIG_IP6_NF_MATCH_IPV6HEADER=y +CONFIG_IP6_NF_MATCH_MH=y +CONFIG_IP6_NF_MATCH_OPTS=y +CONFIG_IP6_NF_MATCH_RT=y CONFIG_IP6_NF_NAT=y CONFIG_IP6_NF_RAW=y CONFIG_IPV6_MIP6=y @@ -141,6 +149,8 @@ CONFIG_JOLIET=y CONFIG_KALLSYMS_ALL=y CONFIG_KPROBES=y CONFIG_KSM=y +CONFIG_LEDS_CLASS=y +CONFIG_LEDS_TRIGGERS=y CONFIG_LEGACY_PTY_COUNT=16 CONFIG_LOG_BUF_SHIFT=14 CONFIG_MAC80211=y @@ -171,6 +181,7 @@ CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y CONFIG_NETFILTER_XT_MATCH_CONNMARK=y CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y CONFIG_NETFILTER_XT_MATCH_DCCP=y +CONFIG_NETFILTER_XT_MATCH_DSCP=y CONFIG_NETFILTER_XT_MATCH_ESP=y CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y CONFIG_NETFILTER_XT_MATCH_HELPER=y @@ -197,6 +208,9 @@ CONFIG_NETFILTER_XT_MATCH_U32=y CONFIG_NETFILTER_XT_SET=y CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y CONFIG_NETFILTER_XT_TARGET_CONNMARK=y +CONFIG_NETFILTER_XT_TARGET_DSCP=y +CONFIG_NETFILTER_XT_TARGET_LED=y +CONFIG_NETFILTER_XT_TARGET_LOG=y CONFIG_NETFILTER_XT_TARGET_MARK=y CONFIG_NETFILTER_XT_TARGET_NFLOG=y CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y @@ -214,12 +228,17 @@ CONFIG_NET_CLS_ACT=y CONFIG_NET_IPIP=y CONFIG_NET_MPLS_GSO=y CONFIG_NET_SCHED=y +CONFIG_NEW_LEDS=y CONFIG_NFS_FS=y CONFIG_NF_CONNTRACK=y CONFIG_NF_CONNTRACK_FTP=y +CONFIG_NF_CONNTRACK_H323=y CONFIG_NF_CONNTRACK_IPV4=y CONFIG_NF_CONNTRACK_IPV6=y +CONFIG_NF_CONNTRACK_IRC=y CONFIG_NF_CONNTRACK_NETBIOS_NS=y +CONFIG_NF_CONNTRACK_PPTP=y +CONFIG_NF_CONNTRACK_SIP=y CONFIG_NF_CONNTRACK_SNMP=y CONFIG_NF_CONNTRACK_TFTP=y CONFIG_NF_CT_NETLINK=y diff --git a/configs/6.13/all-common.inc b/configs/6.13/all-common.inc index 4c71df9..0e9b6d1 100644 --- a/configs/6.13/all-common.inc +++ b/configs/6.13/all-common.inc @@ -87,6 +87,14 @@ CONFIG_INET_IPCOMP=y CONFIG_IP6_NF_FILTER=y CONFIG_IP6_NF_IPTABLES=y CONFIG_IP6_NF_MANGLE=y +CONFIG_IP6_NF_MATCH_AH=y +CONFIG_IP6_NF_MATCH_EUI64=y +CONFIG_IP6_NF_MATCH_FRAG=y +CONFIG_IP6_NF_MATCH_HL=y +CONFIG_IP6_NF_MATCH_IPV6HEADER=y +CONFIG_IP6_NF_MATCH_MH=y +CONFIG_IP6_NF_MATCH_OPTS=y +CONFIG_IP6_NF_MATCH_RT=y CONFIG_IP6_NF_NAT=y CONFIG_IP6_NF_RAW=y CONFIG_IPV6_MIP6=y @@ -141,6 +149,8 @@ CONFIG_JOLIET=y CONFIG_KALLSYMS_ALL=y CONFIG_KPROBES=y CONFIG_KSM=y +CONFIG_LEDS_CLASS=y +CONFIG_LEDS_TRIGGERS=y CONFIG_LEGACY_PTY_COUNT=16 CONFIG_LOG_BUF_SHIFT=14 CONFIG_MAC80211=y @@ -173,6 +183,7 @@ CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y CONFIG_NETFILTER_XT_MATCH_CONNMARK=y CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y CONFIG_NETFILTER_XT_MATCH_DCCP=y +CONFIG_NETFILTER_XT_MATCH_DSCP=y CONFIG_NETFILTER_XT_MATCH_ESP=y CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y CONFIG_NETFILTER_XT_MATCH_HELPER=y @@ -199,6 +210,9 @@ CONFIG_NETFILTER_XT_MATCH_U32=y CONFIG_NETFILTER_XT_SET=y CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y CONFIG_NETFILTER_XT_TARGET_CONNMARK=y +CONFIG_NETFILTER_XT_TARGET_DSCP=y +CONFIG_NETFILTER_XT_TARGET_LED=y +CONFIG_NETFILTER_XT_TARGET_LOG=y CONFIG_NETFILTER_XT_TARGET_MARK=y CONFIG_NETFILTER_XT_TARGET_NFLOG=y CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y @@ -216,12 +230,17 @@ CONFIG_NET_IPIP=y CONFIG_NET_MPLS_GSO=y CONFIG_NET=y CONFIG_NET_SCHED=y +CONFIG_NEW_LEDS=y CONFIG_NFS_FS=y CONFIG_NF_CONNTRACK=y CONFIG_NF_CONNTRACK_FTP=y +CONFIG_NF_CONNTRACK_H323=y CONFIG_NF_CONNTRACK_IPV4=y CONFIG_NF_CONNTRACK_IPV6=y +CONFIG_NF_CONNTRACK_IRC=y CONFIG_NF_CONNTRACK_NETBIOS_NS=y +CONFIG_NF_CONNTRACK_PPTP=y +CONFIG_NF_CONNTRACK_SIP=y CONFIG_NF_CONNTRACK_SNMP=y CONFIG_NF_CONNTRACK_TFTP=y CONFIG_NF_CONNTRACK=y