firewall4/root/sbin, branch master

Revert "fw4: restart in a single nft transaction"

2026-11-03T13:36:44Z

This reverts commit c22c2f241e9e99e93093ba8a8f49bb5a77a325b7. Signed-off-by: Jo-Philipp Wich

fw4: restart in a single nft transaction

2026-11-02T23:15:59Z

"fw4 restart" deleted the fw4 table, then rendered and loaded the ruleset again, in two nft runs. In between there was no fw4 table: no filtering and no NAT. The replies of established masqueraded connections were then no longer translated back, arrived for the router's own address and were answered with resets. The LAN host waiting for them is never told, so a download through the router hangs until the application gives up. Packets forwarded in that window were not filtered either. Delete the table and load the new ruleset in one nft transaction instead. The old ruleset stays in force until the new one replaces it, and unlike a reload the restart still removes everything that is not in the new ruleset. Tested on an x86_64 router with kernel 6.18 and a TCP download through a masqueraded interface: "fw4 restart" made the router send 8 resets and the download never resumed. With this change there is no reset and no gap, a chain and a set added by hand are gone after the restart, and a restart of a stopped firewall loads it. Assisted-by: Claude Code (Claude Opus 5.5) Signed-off-by: Pierre-Yves Le Borgne

init: remove unnecessary stop logic

2025-03-17T15:44:40Z

Always remove table and service state to have consistent cleaned up system state on exit even if user intentionally dropped our table. Removes dependency on grep as a consequence. Ref: https://wiki.nftables.org/wiki-nftables/index.php/Configuring_tables Supersedes: https://github.com/openwrt/firewall4/pull/33 Signed-off-by: Andris PE

cli: introduce test mode and refuse firewall restart on errors

2022-09-01T10:19:14Z

- Introduce a new `fw4 [-q] check` command which tests the rendered ruleset using nftables' --check mode. This is useful to assert complex rulesets using external includes for correctness. - Extend the `fw4 restart` command to check the rendered ruleset before flushing the existing ruleset. Signed-off-by: Jo-Philipp Wich

fw4: add support for configurable includes

2022-06-15T11:32:17Z

Signed-off-by: Jo-Philipp Wich

fw4: prefer /dev/stdin if available

2022-05-31T18:55:36Z

The nftables executable treats `-` and `/dev/stdin` specially when processing nft scripts from stdin; it will buffer the contents in order to be able to print detailled error diagnostics. The `/proc/self/fd/0` path used by `fw4` does not get this special treatment which will lead to nftables error messages without any reported context. Make the `fw4` executable prefer `/dev/stdin` in case it exists and fall back to using `/proc/self/fd/0` as before. Ref: https://github.com/openwrt/openwrt/issues/9927 Ref: https://git.openwrt.org/50bc06e774f89517f98c89c76a7626f35c3ff659 Ref: https://git.netfilter.org/nftables/tree/src/libnftables.c?h=v1.0.3#n733 Signed-off-by: Jo-Philipp Wich

fw4: make `fw4 restart` behavior more robust

2022-05-31T07:36:20Z

Start the firewall on `fw4 restart` even if it was not previously started. Ref: #9935 Signed-off-by: Jo-Philipp Wich

treewide: forward compatibility changes

2022-03-22T20:05:17Z

Adapt testsuite code and fw4 wrapper to current ucode HEAD semantics, in particular ensure that main.uc is invoked as template since ucode now defaults to raw mode for cli invocations. Signed-off-by: Jo-Philipp Wich

treewide: move executables to /sbin

2022-01-06T12:46:35Z

In firewall3, the fw3 executable is installed in /sbin. As luci-app-firewall looks for the fw3 executable in /sbin, the firewall menu is hidden when firewall4 is installed. Move both executables to /sbin so the firewall app will show when firewall4 is installed. Signed-off-by: Stijn Tintel Reviewed-by: Jo-Philipp Wich