Re: Notes on upgrading to version 7.3.0

H John;

sorry for late reply.

Am Dienstag, 6. Februar 2024, 11:45:27 CET schrieb John Sager:
> I've been using version 7.0.2 on a PC Engines APU2C2 as my border
> router/firewall for a couple of years and I decided to upgrade to version
> 7.3.0, it being the latest release. I don't use the 'upgrade' tool but
> instead I have three partitions on the SD card - a vfat boot partition and
> two ext4 partitions for old and new versions. This makes it easy to just
> reboot the old version if the new one misbehaves.

Honestly, ido the same - having three versions on my router - old and 
ultrastable, if everything goes wrong, stable with a current version having 
usual updates and testing for cutting edge.

> Additionally I had moved to using nftables on 7.0.2 to create the firewall
> rules and packet marking rules for traffic control. I wanted to try it out
> in a real environment. Previously I used hand-crafted iptables rules rather
> than shorewall anyway for more flexibility.
> 
> I like nftables so I am sticking with it. For this release I cloned the
> bering development git repository on sourceforge to build nftables. I had to
> use version 1.0.6 of nftables rather than the latest version (1.0.9) as it
> has to work with the release version (1.2.5) of libnftnl. Besides libnftnl
> it also needs libmnl (already in initrd, as I eventually realised),
> libedit, libgmp and libjansson. Those libraries and all the other packages
> are from Bering-uClibc_7.3.0_x86_64_syslinux_serial115200.tar.gz.
> 
> On first booting into the new version I got errors. nftables didn't work as
> I had made a small build error but that was easily fixed. However a couple
> of other applications also failed:
> 
> ntpd requires libcap though it isn't listed in ntpd.deplrp, so libcap needs
> to go in the list of packages to load in leaf.cfg. This was also raised by
> Robert K Coffman jr on leaf-user in August 2023.

Yeap, for got to commit the fix previously, done.

> tc requires libxtables. When using iptables, that library would normally get
> loaded automatically but I don't use iptables, so libiptbl (where
> libxtables lives) goes in the package list in leaf.cfg.

It most probably won't  do any harm if libiptbl would be added to tc.lrp as 
requirement.

> So far the new version has been working for over 24 hours with no obvious
> issues.
> 
> If there is a demand for nftables perhaps it could be added to the distro? I
> can supply the config and the repo that I have used successfully now in two
> versions of Bering-uClibc as a template.

Please do - it will be welcome.
As nothing has changed in the git permissions since you've committed the first 
wireguard packages years ago, you should be able to do so for nftables as 
well.

regards kp


> regards,
> 
> John Sager
> 
> 
> 
> 
> 
> ------------------------------------------------------------------------
> leaf-user mailing list: [email protected]
> https://lists.sourceforge.net/lists/listinfo/leaf-user
> Support Request -- http://leaf-project.org/






------------------------------------------------------------------------
leaf-user mailing list: [email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/