software offloading ignores pppoe-wan interface

[justinian-tomegea]

Bellow there is a the diff between nft rulesets without and with the software offloading:

`diff 'nft list ruleset' 'nft list ruleset sw'
2a3,8

flowtable ft {
hook ingress priority filter
devices = { "br-lan", "eth1" }
counter
}

13a20

  meta l4proto { tcp, udp } flow add @ft

61c68
< iifname "br-lan" counter packets 3006 bytes 207188 accept comment "!fw4: accept lan IPv4/IPv6 traffic"

  iifname "br-lan" counter packets 9 bytes 569 accept comment "!fw4: accept lan IPv4/IPv6 traffic"

65c72
< oifname "br-lan" counter packets 8 bytes 2344 accept comment "!fw4: accept lan IPv4/IPv6 traffic"

  oifname "br-lan" counter packets 0 bytes 0 accept comment "!fw4: accept lan IPv4/IPv6 traffic"

93,94c100,101
< meta nfproto ipv4 oifname "pppoe-wan" ct state invalid counter packets 31 bytes 1612 drop comment "!fw4: Prevent NAT leakage"
< oifname "pppoe-wan" counter packets 9373 bytes 2190755 accept comment "!fw4: accept wan IPv4/IPv6 traffic"

  meta nfproto ipv4 oifname "pppoe-wan" ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage"
  oifname "pppoe-wan" counter packets 2 bytes 152 accept comment "!fw4: accept wan IPv4/IPv6 traffic"

98c105
< iifname "pppoe-wan" counter packets 6582 bytes 404426 drop comment "!fw4: drop wan IPv4/IPv6 traffic"

  iifname "pppoe-wan" counter packets 2 bytes 169 drop comment "!fw4: drop wan IPv4/IPv6 traffic"

130,132c137,139
< meta nfproto ipv4 tcp dport cctv-port-redacted counter packets 1170 bytes 70000 dnat ip to 10.10.10.5:cctv-port-redacted comment "!fw4: @reDIrect[0]"
< meta nfproto ipv4 udp dport cctv-port-redacted counter packets 20 bytes 1925 dnat ip to 10.10.10.5:cctv-port-redacted comment "!fw4: @reDIrect[0]"
< meta nfproto ipv4 tcp dport 8443 counter packets 84 bytes 4252 dnat ip to 10.10.10.5:22 comment "!fw4: @reDIrect[1]"

  meta nfproto ipv4 tcp dport cctv-port-redacted counter packets 1 bytes 60 dnat ip to 10.10.10.5:cctv-port-redacted comment "!fw4: @redirect[0]"
  meta nfproto ipv4 udp dport cctv-port-redacted counter packets 0 bytes 0 dnat ip to 10.10.10.5:cctv-port-redacted comment "!fw4: @redirect[0]"
  meta nfproto ipv4 tcp dport 8443 counter packets 0 bytes 0 dnat ip to 10.10.10.5:22 comment "!fw4: @redirect[1]"`

This line:

> devices = { "br-lan", "eth1" }

basically is not showing the pppoe-wan iface.

As such software offloading being enabled prevents SQM to categorise the packets correctly and tc -s qdisc is not showing the packet are being properly tagged.

More info at: https://forum.openwrt.org/t/sqm-per-host-isolation/251678

[brada4]

ppoe-wan - yes in 3 years since splitting soft and hard device lists nobody came up with smart heuristics to soft-offload pppoe-ean or to hard-offload docker0 , kind of code is open, give it a try

offloading bypasses all ruleset, you cannot tag or drop or mark packets that never cross ruleset in first place.

[brada4]

devices = { "br-lan", "eth1" }
this is additive

Save to /etc/nftables.d/whatever.nft

flowtable ft {
hook ingress priority filter
devices = { "pppoe-wan" }
counter
}

interface has to exist, it is like iif, not iifname