Flint 3 - ipset cannot use src_net, but src_ip works

Routers
1

This is my first time using GLiNet router (Flint 3) and it has been a great experience so far! However, I am not familiar with openWRT and I currently have a problem setting up an ipset within LuCI.

My goal is to have port forwarding with IP whitelist (in the form of a file). In the GLiNet admin panel, I have created a rule for the port forwarding part easily and it works as expected.

Now to have the whitelist, I went to the LuCI panel and go to Network -> Panel -> IP Sets. Then I do the following.

  1. Create a new IP set
  2. Select "Packet Field Match" to "src_net"
  3. Upload and select my whitelist file containing IPs with CIDR notation
  4. Use the newly created ipset in the port forwarding rule

This does not work. If i went to the router via ssh then check the list with nft list sets, there is no list at all. However, when I change the "Packet Field Match" to "src_ip" and check it again with nft list sets, the list will be visible (but without the CIDR notation, since it is parsed as an IP and not subnet).

Using this ipset with "src_ip" works. For example if the file contains 1.2.3.4/8 it will be parsed as 1.2.3.4 and I can access the forwarded port from that IP, so I am sure that I did the rules correctly. It seems to me that the option "src_net" simply doesn't work or I misunderstood it. Can anyone point me on how to use a list with subnet? Thanks!

2

Hello,

Please try to disable the network acceleration first in GL GUI.

4

Hello,

I did more tests and I think I have found the problem. Running service firewall reload after I created the ipset and use it in the port forward rules return the following error.

root@GL-BE9300:~# service firewall reload
Section @ipset[0] (test) match type 'net' requires kernel 5.6 or later
...

root@GL-BE9300:~# uname -r
5.4.213

So it seems that this function is not possible with the current kernel version. Is there any plan to update the kernel for Flint 3?

5

+1
I have the same issue.

6

Hello,

R&D team is checking the SDK.

7

can anyone else confirm that opkg install kmod-sctp ends up with roouter crash/reboot ?