A package is missed while we switch mwan3 to kmwan:
opkg update
opkg install iptables-mod-conntrack-extra
/etc/init.d/firewall restart
1 Like
Hi @hansome
Unfortunately, it didn’t work. On my Flint, it broke the internet. It became EXTREMELY SLOW, to the point most webpages won’t even load. I tried restarting the router, no help.
Then I ran opkg remove iptables-mod-conntrack-extra; /etc/init.d/firewall restart, then, it fixed the problem of slow internet.
In both cases, I still can’t access LAN services through real IP with active VPN client ON.
Please export log for analysis. http://192.168.8.1/#/logview
Please see attached log. Please note that some sensitive information are redacted.
logread.zip (31.8 KB)
These commands are not necessary to manually input for firmware 4.5:
uci set firewall.wan_in_conn_mark=rule
...
uci set firewall.wan_in_conn_mark.set_xmark='0x80000/0x80000'
...
To revert that:
sh /rom/etc/uci-defaults/99-vpnpolicy
uci commit
/etc/init.d/firewall reload
See if it fixes your issue.
Was this specific to @briar-spoon-celibate’s configuration, or does this need to be updated for everyone in addition to installing the iptables-mod-conntrack-extra package?
1 Like
Only need to install iptables-mod-conntrack-extra package
The correct firewall mark is 0x8000/0xc000 like the following:
root@GL-AX1800:~# uci get firewall.wan_in_conn_mark.set_xmark
0x8000/0xc000
It worked. Thanks.
Do you mind expanding why we no longer need those rules?
We have those rules written in firewall since firmware 4.4.6, but miss that supporting package(iptables-mod-conntrack-extra) in firmware 4.5. 
And 4.5 change the mark 0x80000 to 0x8000, to make it compatible with upstream tailscale.
Hotfix when?
3 Likes
We’ll evaluate to release a minor version to address this ASAP.
4 Likes
Hello,
I didn't need this for a while, but now I just upgraded to 4.7.0 release8, and tried to make it work again but it doesn't, and I'm a bit lost with all has been posted here.
I tried this again like I was used to:
cat >/etc/firewall.swap_wan_in_conn_mark.sh <<EOF
#!/bin/sh
iptables-save -t mangle |sed '/_in_conn_mark/ s/-A PREROUTING/-I PREROUTING/' | iptables-restore -T mangle
EOF
But it didn't work.
Then I tried this
opkg update
opkg install iptables-mod-conntrack-extra
/etc/init.d/firewall restart
The firewall restart command exited with failure, and I couldn't have Wi-Fi working anymore, I was afraid I bricked my Flint but luckily it's not, Wi-Fi went back up after a while. I guess I'll try no more random commands.
So what it the way to have this work now ?
Thanks
I tested 4.7.0 release8 for ax1800, it doesn't need any extra command.
Port forwarding from WAN to LAN is working when VPN client is on.
I'll PM you for further log checking.
I did send you a log export, I don't know if you could check on it yet.
Actually for a few days I have noticed another problem, that may be related (if it's not I'll create a dedicated topic later): the problem is that DDNS always resolves to VPN IP, even with Services from GL.iNET Use VPN option at off. It feels like non-VPN traffic is ignored or forced through VPN.
I precise that Block Non-VPN Traffic option in client VPN is off, and Allow Access WAN is on.
Hope this will help investigating.
I also found the DDNS Test doesn't behave as expected.
Thanks for the clue.
I didn't reproduce the original issue, it works when I access wan->lan port forward port.
I also get those info from your log:
You set up vlan policy, guest network not using
with wgclient wgserver cascaded on
with both cable and repeater WAN
AdGuard Home Handle Client Requests is on
But I found some other issues. I'll continue to test.
1 Like
The workaround for ax1800/axt1800 4.7.0.
sed -i 's/iifname "wlan-sta0"/iifname { "sta*", "wlan-sta*" }/g' /etc/firewall.in_conn_mark.nft
nft -f /etc/firewall.in_conn_mark.nft
We'll release a new firmware including this fix.
1 Like
It's working fine now, thank you !
Now I've done this I have another problem. I cannot access VPN server from WAN anymore.
While I'm in the LAN (connected to WiFi) I can access the WG server from my phone, but as soon as I turn off phone WiFi and access the internet through 5G, the WG client on my phone gets no packet anymore from Flint, rx packets remain at 0 while tx increase.
I precise I access the WG server with direct IP, while DDNS doesn't work.
Another precision: connection to WG server only works if I'm in the VLAN that doesn't gets out through VPN (the Guest network). From the LAN network which goes through VPN it doesn't.
Yes, DDNS issues using VPNs do exist; we're releasing new firmware to address this.
Do you mean connecting to the wireguard server in router's lan or guest network?
Edit: After further investigation, it seems that the problem came from my upper subnet which was blocking the incoming WG traffic, I changed the default port and now everything is working again. My bad ! Problem solved 
1 Like