firewall4/root, branch master

Revert "fw4: restart in a single nft transaction"

2026-11-03T13:36:44Z

This reverts commit c22c2f241e9e99e93093ba8a8f49bb5a77a325b7. Signed-off-by: Jo-Philipp Wich

config: mark unsupported fw3 options correctly

2026-11-02T23:57:55Z

- mark sysctl-based fw3 options UNSUPPORTED, emitting warning - remove notion of unsupported option from default config file No change in ruleset logic. Signed-off-by: Andris PE

Set has_ports for helper rules and require helper port

2026-11-02T23:49:14Z

Helper definitions are used to generate automatic `ct helper set` rules. A helper without a port cannot produce a meaningful assignment rule, so make `port` mandatory in `parse_helper()`. The generated helper rule now also carries `has_ports: true`, which suppresses the redundant `meta l4proto` match via the normal `has_ports` guard instead of special-casing `set_helper` in the template. No behavior change for valid helpers. Suggested-by: Andris PE [require helper port and set has_ports instead of special-casing set_helper] Signed-off-by: Jo-Philipp Wich

templates: remove stray file

2026-11-02T23:29:26Z

Fixes: https://github.com/openwrt/firewall4/issues/86 Signed-off-by: Andris PE

fw4: support multiple ipset references per rule and redirect

2026-11-02T23:25:34Z

The `list ipset` option has AND semantics: all listed references are AND-ed into one nft rule. Co-Authored-By: Claude Fable 5.1 Signed-off-by: Philipp Raschdorff [shorten comment] Signed-off-by: Jo-Philipp Wich

fw4: reject unknown tokens in ipset references

2026-11-02T23:15:59Z

parse_setmatch() ignores every token after the set name that is not a direction (`src`, `dst`, `dest`). `option ipset 'setA setB'` is therefore accepted as a reference to setA only, and the rule silently matches fewer conditions than configured. With list support for the option this mistake becomes likely. Reject the value if it has more than three tokens or a token that is not a direction. An invalid value drops the section with the usual "specifies invalid value" warning (fail-closed). This is a behaviour change: a configuration that relied on unknown tokens being ignored loses the affected rule after the update. For an ACCEPT rule that closes access; for a DROP or REJECT rule it removes the block, which is the opposite of fail-closed. Both cases are reported with a warning, but nothing else draws attention to them. If that risk is considered too high, the alternative is to keep accepting the reference and only warn about the ignored tokens; this patch is submitted separately so that it can be discussed and dropped on its own. Co-Authored-By: Claude Fable 5.1 Signed-off-by: Philipp Raschdorff

fw4: add WDS ports to the flowtable by prefix

2026-11-02T23:15:59Z

fw4 reads the bridge members from sysfs when it renders the ruleset and lists each member by name in the hardware offload flowtable. hostapd creates the port of a 4-address station as .sta when the station associates. A port that comes up after the last reload under a name that was not in use then joins the bridge, but not the flowtable, and its upload takes the slow path until the next reload. The kernel binds a flowtable hook with a name prefix to each device that registers later under a matching name, the hardware block included. So list .sta* for each wireless member and drop the port names, because the kernel refuses a list that holds a prefix and a name under it. Each wireless member gets the prefix, also one without a port at the time of the render, because the reloads at boot run before the first station associates. A name prefix in a flowtable needs the NFTA_DEVICE_PREFIX attribute of Linux 6.17, which nftables 1.1.6 and later send. An older kernel refuses it, so the check of hardware offload would fail and fw4 would fall back to software offloading. So fw4 uses the prefix only on Linux 6.17 and later, and lists the port names as before on an older kernel. Software offloading lists the zone devices and does not change. Signed-off-by: Koral Ilgun

fw4: restart in a single nft transaction

2026-11-02T23:15:59Z

"fw4 restart" deleted the fw4 table, then rendered and loaded the ruleset again, in two nft runs. In between there was no fw4 table: no filtering and no NAT. The replies of established masqueraded connections were then no longer translated back, arrived for the router's own address and were answered with resets. The LAN host waiting for them is never told, so a download through the router hangs until the application gives up. Packets forwarded in that window were not filtered either. Delete the table and load the new ruleset in one nft transaction instead. The old ruleset stays in force until the new one replaces it, and unlike a reload the restart still removes everything that is not in the new ruleset. Tested on an x86_64 router with kernel 6.18 and a TCP download through a masqueraded interface: "fw4 restart" made the router send 8 resets and the download never resumed. With this change there is no reset and no gap, a chain and a set added by hand are gone after the restart, and a restart of a stopped firewall loads it. Assisted-by: Claude Code (Claude Opus 5.5) Signed-off-by: Pierre-Yves Le Borgne

ruleset: Add snat_port support for MASQUERADE

2026-11-02T23:15:59Z

Currently, MASQUERADE in firewall4 does not support setting snat_port and directly reports an error without creating rules. This modification enables MASQUERADE to support setting snat_port. Signed-off-by: HSXX <513733973@qq.com> [folded fix: keep the masquerade branch alongside the npt prefix_map branch] Signed-off-by: Jo-Philipp Wich

ruleset: avoid no-op port translation in dnat

2026-11-02T23:15:59Z

Correct rport null propagation moving compensatory conditional to reflection snat rule only. Emit shorthand rules if user did not specify redirect target port This saves 2 bytecodes in rule and kernel does not do no-op port rewrite. V2 Adjust tests to cover more cases/code paths V3 Adjust uci example to reflect default of not changing dport Signed-off-by: Andris PE [folded fix: merge redirect test expectations with #104 and update ubus reflection expectations] Signed-off-by: Jo-Philipp Wich