Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OpenWrt 22.03 后默认使用nftables,好像会导致udp2raw握手失败 #464

Closed
void285 opened this issue Mar 31, 2023 · 1 comment
Closed

Comments

@void285
Copy link

void285 commented Mar 31, 2023

之前客户端一直运行在OpenWrt19.07上,分别试用两年前和最新的版本,都没有问题。
另一台设备安装了22.03的OpenWrt,运行同样两个版本的udp2raw客户端,尝试连接相同的服务器,但始终无法与服务器建立稳定连接。

服务器日志中循环以下内容:

[2023-03-31 20:30:05][INFO][xxx.xx.xx.xx:13406]got packet from a new ip
[2023-03-31 20:30:05][INFO][xxx.xx.xx.xx:13406]created new conn,state: server_handshake1,my_id is 56518f7e
[2023-03-31 20:30:05][INFO][xxx.xx.xx.xx:13406]changed state to server_handshake1,my_id is 56518f7e
[2023-03-31 20:30:05][INFO][xxx.xx.xx.xx:13406]received handshake oppsite_id:8b1e205b  my_id:56518f7e
[2023-03-31 20:30:05][INFO][xxx.xx.xx.xx:13406]oppsite const_id:2ece1aab
[2023-03-31 20:30:05][INFO][xxx.xx.xx.xx:13406]grabbed a connection
[2023-03-31 20:30:07][INFO][xxx.xx.xx.xx:13403]inactive conn cleared
[2023-03-31 20:30:11][INFO][xxx.xx.xx.xx:13411]received syn,sent syn ack back

[2023-03-31 20:30:11][INFO][xxx.xx.xx.xx:13411]got packet from a new ip
... ...

一开始完全没头绪,后来发现22.03版OpenWrt的概览->防火墙url为 http://192.168.1.1/cgi-bin/luci/admin/status/nftables,页面有如下提示,于是怀疑是防火墙导致的:

系统上存在旧版 iptables 规则。
不鼓励混合使用 iptables 和 nftables 规则,这可能会导致流量过滤不完整。

作为对比,旧版本的OpenWrt的概览->防火墙url为http://192.168.1.1/cgi-bin/luci/admin/status/iptables,另外[OpenWrt的wiki页面](https://openwrt.org/docs/guide-user/firewall/misc/nftables)提示:`Since OpenWrt 22.03, fw4 is used by default, and it generates nftables rules.`,我怀疑nftables导致了握手失败。

@void285
Copy link
Author

void285 commented Apr 3, 2023

问题解决了,跟防火墙没关系,iptables和nftables的混用、那个提示都没关系。原因是服务器使用了fix-gro参数,而这次客户端这里忘记了加fix-gro参数。

前两年配置老路由器的时候修改了/etc/init.d/udp2raw,让它运行二进制文件前在临时生成的配置文件中加入这个参数,这次在新路由器上重新配置系统,忘记做这个修改了,改了就好了。

最后一行就是需要加的内容,如果luci-app-udp2raw可以配置这个选项会好些,可以帮助排查配置项上的差异。

[ -n "$log_level" ] && echo "--log-level ${log_level}" >> $config_file
        echo "--disable-color" >> $config_file
        echo "--fix-gro" >> $config_fil

@void285 void285 closed this as completed Apr 3, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant