OpenWrt nftables firewall https://git.openwrt.org/project/firewall4/atom?h=master 2026-10-25T10:19:25Z 2026-10-25T10:19:25Z Julius Bairaktaris 2026-10-18T13:43:11Z urn:sha1:a3296754c154c9a0203a8ab72820da0b381aaddd Since Linux commit 871df5007eda ("netfilter: flowtable: bail out if forward path cannot be discovered"), a flow is offloaded only if the ingress device at the bottom of its forward path is a flowtable device. For a bridge that is the bridge port, such as a DSA user port or a wireless interface, not the bridge itself. With software offloading, fw4 lists only the zone devices, so flows through br-lan or a VLAN under the WAN stay on the classic path. Resolve the lower devices for software offloading as for hardware offloading. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/firewall4/pull/108 Signed-off-by: Robert Marko <robimarko@gmail.com>