Re: Notes on upgrading to version 7.3.0

KP,

Ok I'll commit nftables to the git repository but it will be a week or two before I can do so. Which branch should I use for the commit?

regards,

John


On 6 March 2024 16:20:36 GMT, "KP.Kirchdoerfer" <[email protected]> wrote:
>H John;
>
>sorry for late reply.
>
>Am Dienstag, 6. Februar 2024, 11:45:27 CET schrieb John Sager:
>> I've been using version 7.0.2 on a PC Engines APU2C2 as my border
>> router/firewall for a couple of years and I decided to upgrade to version
>> 7.3.0, it being the latest release. I don't use the 'upgrade' tool but
>> instead I have three partitions on the SD card - a vfat boot partition and
>> two ext4 partitions for old and new versions. This makes it easy to just
>> reboot the old version if the new one misbehaves.
>
>Honestly, ido the same - having three versions on my router - old and 
>ultrastable, if everything goes wrong, stable with a current version having 
>usual updates and testing for cutting edge.
>
>> Additionally I had moved to using nftables on 7.0.2 to create the firewall
>> rules and packet marking rules for traffic control. I wanted to try it out
>> in a real environment. Previously I used hand-crafted iptables rules rather
>> than shorewall anyway for more flexibility.
>> 
>> I like nftables so I am sticking with it. For this release I cloned the
>> bering development git repository on sourceforge to build nftables. I had to
>> use version 1.0.6 of nftables rather than the latest version (1.0.9) as it
>> has to work with the release version (1.2.5) of libnftnl. Besides libnftnl
>> it also needs libmnl (already in initrd, as I eventually realised),
>> libedit, libgmp and libjansson. Those libraries and all the other packages
>> are from Bering-uClibc_7.3.0_x86_64_syslinux_serial115200.tar.gz.
>> 
>> On first booting into the new version I got errors. nftables didn't work as
>> I had made a small build error but that was easily fixed. However a couple
>> of other applications also failed:
>> 
>> ntpd requires libcap though it isn't listed in ntpd.deplrp, so libcap needs
>> to go in the list of packages to load in leaf.cfg. This was also raised by
>> Robert K Coffman jr on leaf-user in August 2023.
>
>Yeap, for got to commit the fix previously, done.
>
>> tc requires libxtables. When using iptables, that library would normally get
>> loaded automatically but I don't use iptables, so libiptbl (where
>> libxtables lives) goes in the package list in leaf.cfg.
>
>It most probably won't  do any harm if libiptbl would be added to tc.lrp as 
>requirement.
>
>> So far the new version has been working for over 24 hours with no obvious
>> issues.
>> 
>> If there is a demand for nftables perhaps it could be added to the distro? I
>> can supply the config and the repo that I have used successfully now in two
>> versions of Bering-uClibc as a template.
>
>Please do - it will be welcome.
>As nothing has changed in the git permissions since you've committed the first 
>wireguard packages years ago, you should be able to do so for nftables as 
>well.
>
>regards kp
>
>
>> regards,
>> 
>> John Sager
>> 
>> 
>> 
>> 
>> 
>> ------------------------------------------------------------------------
>> leaf-user mailing list: [email protected]
>> https://lists.sourceforge.net/lists/listinfo/leaf-user
>> Support Request -- http://leaf-project.org/
>
>
>
>
>
>
>------------------------------------------------------------------------
>leaf-user mailing list: [email protected]
>https://lists.sourceforge.net/lists/listinfo/leaf-user
>Support Request -- http://leaf-project.org/

-- 
Sent from the aether.
------------------------------------------------------------------------
leaf-user mailing list: [email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/