3 ms·

I wish OpenWRT had LTS releases... I'm still on 21.02.7 because they switched to nftables syntax for custom rules ("firewall.user") in 22.03 and I have a pile

by CrLf 3y ago

I wish OpenWRT had LTS releases... I'm still on 21.02.7 because they switched to nftables syntax for custom rules ("firewall.user") in 22.03 and I have a pile of them and haven't had the time to rewrite it all. This release means 21.02 will have no more security updates.

molticrystal 3y ago
It wasn't a pleasant task but when I ripped the band-aid off and converted my rules, I took it as an opportunity to reevaluate them and was able optimize a lot of them, converting to IPSSETs, tweaking them into CIDR ranges, pruning, etc and got a decent speed boost. Maybe that isn't applicable to you, but something to keep in mind.
pword 3y ago
Ask chatgpt? Pretty good example of a thing it'll probably handle in a second.
- chx 3y ago
  Please publish the IP of the router that runs firewall rules generated by ChatGPT. I will bring the popcorn.
Sunspark 3y ago
I'm still on 18. I'll probably switch to 23 sometime. The device is stable and I'm the only one using it so I didn't feel any pressing rush to deal with the hassle since a lot of "security" issues are often from the inside not the outside. So I would say don't stress overmuch about it.
- e2le 3y ago
  Unfortunately there's some RCE vulnerabilities and other nasty bugs between 18 and 23 that can be exploited remotely. I wouldn't feel safe running an unpatched version if it can be helped. https://openwrt.org/docs/guide-developer/security https://openwrt.org/docs/guide-developer/security
  - CrLf 3y ago
    I don't advocate staying on an older version, but that depends on the services you have running. If you don't have any external service, you should be OK. I tend to minimize internal services as well. I don't use OpenWRT as a general purpose server. Still, an LTS release from time to time would be good (the effort would be the same, as there would still be only two maintained releases: the current stable and the LTS).
guerby 3y ago
nftables has a converter from iftables: https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_nftables https://wiki.nftables.org/wiki-nftables/index.php/Moving_fro... But it might not cover all of your existing iptables rules.
- CrLf 3y ago
  Syntax is the least of the problems. The main problem is the ruleset structure they've chosen which, for example, no longer includes user customizable chains. This means I'll have to rethink my rules to make sure they play nice with the default ruleset. They seem to be forcing the use of the UI for creating rules, but that doesn't cover some that I have (part of which are generated dynamically). Worse, I'll have to go through 22.03 because they don't support upgrading from 21.02 to 23.05.

by CrLf 3y ago

molticrystal 3y ago

It wasn't a pleasant task but when I ripped the band-aid off and converted my rules, I took it as an opportunity to reevaluate them and was able optimize a lot of them, converting to IPSSETs, tweaking them into CIDR ranges, pruning, etc and got a decent speed boost. Maybe that isn't applicable to you, but something to keep in mind.

pword 3y ago

Ask chatgpt? Pretty good example of a thing it'll probably handle in a second.

chx 3y ago
Please publish the IP of the router that runs firewall rules generated by ChatGPT. I will bring the popcorn.

Sunspark 3y ago

I'm still on 18. I'll probably switch to 23 sometime. The device is stable and I'm the only one using it so I didn't feel any pressing rush to deal with the hassle since a lot of "security" issues are often from the inside not the outside. So I would say don't stress overmuch about it.

e2le 3y ago
Unfortunately there's some RCE vulnerabilities and other nasty bugs between 18 and 23 that can be exploited remotely. I wouldn't feel safe running an unpatched version if it can be helped. https://openwrt.org/docs/guide-developer/security https://openwrt.org/docs/guide-developer/security
- CrLf 3y ago
  I don't advocate staying on an older version, but that depends on the services you have running. If you don't have any external service, you should be OK. I tend to minimize internal services as well. I don't use OpenWRT as a general purpose server. Still, an LTS release from time to time would be good (the effort would be the same, as there would still be only two maintained releases: the current stable and the LTS).

guerby 3y ago

nftables has a converter from iftables: https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_nftables https://wiki.nftables.org/wiki-nftables/index.php/Moving_fro... But it might not cover all of your existing iptables rules.

CrLf 3y ago
Syntax is the least of the problems. The main problem is the ruleset structure they've chosen which, for example, no longer includes user customizable chains. This means I'll have to rethink my rules to make sure they play nice with the default ruleset. They seem to be forcing the use of the UI for creating rules, but that doesn't cover some that I have (part of which are generated dynamically). Worse, I'll have to go through 22.03 because they don't support upgrading from 21.02 to 23.05.