Notes on upgrading to version 7.3.0

I've been using version 7.0.2 on a PC Engines APU2C2 as my border 
router/firewall for a couple of years and I decided to upgrade to version 
7.3.0, it being the latest release. I don't use the 'upgrade' tool but 
instead I have three partitions on the SD card - a vfat boot partition and 
two ext4 partitions for old and new versions. This makes it easy to just 
reboot the old version if the new one misbehaves.

Additionally I had moved to using nftables on 7.0.2 to create the firewall 
rules and packet marking rules for traffic control. I wanted to try it out 
in a real environment. Previously I used hand-crafted iptables rules rather 
than shorewall anyway for more flexibility.

I like nftables so I am sticking with it. For this release I cloned the 
bering development git repository on sourceforge to build nftables. I had to 
use version 1.0.6 of nftables rather than the latest version (1.0.9) as it 
has to work with the release version (1.2.5) of libnftnl. Besides libnftnl 
it also needs libmnl (already in initrd, as I eventually realised), libedit, 
libgmp and libjansson. Those libraries and all the other packages are from 
Bering-uClibc_7.3.0_x86_64_syslinux_serial115200.tar.gz.

On first booting into the new version I got errors. nftables didn't work as 
I had made a small build error but that was easily fixed. However a couple 
of other applications also failed:

ntpd requires libcap though it isn't listed in ntpd.deplrp, so libcap needs 
to go in the list of packages to load in leaf.cfg. This was also raised by 
Robert K Coffman jr on leaf-user in August 2023.

tc requires libxtables. When using iptables, that library would normally get 
loaded automatically but I don't use iptables, so libiptbl (where libxtables 
lives) goes in the package list in leaf.cfg.

So far the new version has been working for over 24 hours with no obvious 
issues.

If there is a demand for nftables perhaps it could be added to the distro? I 
can supply the config and the repo that I have used successfully now in two 
versions of Bering-uClibc as a template.

regards,

John Sager





------------------------------------------------------------------------
leaf-user mailing list: [email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/