YouTube traffic does not get into nft chains YouTubeUnblock

[pavelmakhanko]

On SNR-CPE-W4N device, youtube traffic is not hitting the right chains. ` root@OpenWrt:~# nft list ruleset table inet fw4 { chain input { type filter hook input priority filter; policy drop; iif "lo" accept comment "!fw4: Accept traffic from loopback" ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" tcp flags syn / fin,syn,rst,ack jump syn_flood comment "!fw4: Rate limit TCP syn packets" iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic" iifname "eth0.2" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic" jump handle_reject }

chain forward {
    type filter hook forward priority filter; policy drop;
    ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows"
    iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
    iifname "eth0.2" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
    jump handle_reject
}

chain output {
    type filter hook output priority filter; policy accept;
    meta mark & 0x00008000 == 0x00008000 counter packets 0 bytes 0 accept
    oif "lo" accept comment "!fw4: Accept traffic towards loopback"
    ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
    oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
    oifname "eth0.2" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
}

chain prerouting {
    type filter hook prerouting priority filter; policy accept;
    iifname "br-lan" jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment"
}

chain handle_reject {
    meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
    reject comment "!fw4: Reject any other traffic"
}

chain syn_flood {
    limit rate 25/second burst 50 packets return comment "!fw4: Accept SYN packets below rate-limit"
    drop comment "!fw4: Drop excess packets"
}

chain input_lan {
    jump accept_from_lan
}

chain output_lan {
    jump accept_to_lan
}

chain forward_lan {
    jump accept_to_wan comment "!fw4: Accept lan to wan forwarding"
    jump accept_to_lan
}

chain helper_lan {
}

chain accept_from_lan {
    iifname "br-lan" counter packets 92 bytes 27078 accept comment "!fw4: accept lan IPv4/IPv6 traffic"
}

chain accept_to_lan {
    oifname "br-lan" counter packets 22 bytes 1720 accept comment "!fw4: accept lan IPv4/IPv6 traffic"
}

chain input_wan {
    meta nfproto ipv4 udp dport 68 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCP-Renew"
    icmp type echo-request counter packets 0 bytes 0 accept comment "!fw4: Allow-Ping"
    meta nfproto ipv4 meta l4proto igmp counter packets 0 bytes 0 accept comment "!fw4: Allow-IGMP"
    meta nfproto ipv6 udp dport 546 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCPv6"
    ip6 saddr fe80::/10 icmpv6 type . icmpv6 code { mld-listener-query . no-route, mld-listener-report . no-route, mld-listener-done . no-route, mld2-listener-report . no-route } counter packets 0 bytes 0 accept comment "!fw4: Allow-MLD"
    icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply, nd-router-solicit, nd-router-advert } limit rate 1000/second burst 5 packets counter packets 1 bytes 56 accept comment "!fw4: Allow-ICMPv6-Input"
    icmpv6 type . icmpv6 code { packet-too-big . no-route, parameter-problem . no-route, nd-neighbor-solicit . no-route, nd-neighbor-advert . no-route, parameter-problem . admin-prohibited } limit rate 1000/second burst 5 packets counter packets 6 bytes 408 accept comment "!fw4: Allow-ICMPv6-Input"
    jump reject_from_wan
}

chain output_wan {
    jump accept_to_wan
}

chain forward_wan {
    icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
    icmpv6 type . icmpv6 code { packet-too-big . no-route, parameter-problem . no-route, parameter-problem . admin-prohibited } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
    meta l4proto esp counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: Allow-IPSec-ESP"
    udp dport 500 counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: Allow-ISAKMP"
    jump reject_to_wan
}

chain accept_to_wan {
    meta nfproto ipv4 oifname "eth0.2" ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage"
    oifname "eth0.2" counter packets 79 bytes 5856 accept comment "!fw4: accept wan IPv4/IPv6 traffic"
}

chain reject_from_wan {
    iifname "eth0.2" counter packets 56 bytes 24365 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
}

chain reject_to_wan {
    oifname "eth0.2" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
}

chain dstnat {
    type nat hook prerouting priority dstnat; policy accept;
}

chain srcnat {
    type nat hook postrouting priority srcnat; policy accept;
    oifname "eth0.2" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
}

chain srcnat_wan {
    meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic"
}

chain raw_prerouting {
    type filter hook prerouting priority raw; policy accept;
}

chain raw_output {
    type filter hook output priority raw; policy accept;
}

chain mangle_prerouting {
    type filter hook prerouting priority mangle; policy accept;
}

chain mangle_postrouting {
    type filter hook postrouting priority mangle; policy accept;
    oifname "eth0.2" tcp flags syn / fin,syn,rst tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 egress MTU fixing"
}

chain mangle_input {
    type filter hook input priority mangle; policy accept;
}

chain mangle_output {
    type route hook output priority mangle; policy accept;
}

chain mangle_forward {
    type filter hook forward priority mangle; policy accept;
    tcp dport 443 ct original packets < 20 counter packets 0 bytes 0 queue flags bypass to 537
    iifname "eth0.2" tcp flags syn / fin,syn,rst tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 ingress MTU fixing"
}

} `

DISTRIB_ARCH='mipsel_24kc' OpenWrt SNAPSHOT, r27194-a2662309aa 1553 1 root S< 1236 2% 0% /usr/bin/youtubeUnblock --sni-domains=all --faking-strategy=ttl --faking-ttl=4 --fk-winsize=1 root@OpenWrt:~# opkg list | grep kmod-nfnetlink-queue kmod-nfnetlink-queue - 6.6.47-r1

root@OpenWrt:~# opkg list | grep kmod-nft-queue kmod-nft-queue - 6.6.47-r1

root@OpenWrt:~# opkg list | grep kmod-nf-conntrack kmod-nf-conntrack - 6.6.47-r1 kmod-nf-conntrack6 - 6.6.47-r1

[Waujito]

youtube traffic from router should not be handled by youtubeUnblock, normally it should go through the forward mangle chain.

[pavelmakhanko]

What could be the problem with my device?

[bvasiliev]

Did you have hardware NAT offload enabled on your device? If so, most packets may not reach mangle_forward chain and may not be processed by the app.

Try to disable NAT offload / "Разгрузка соединений".

[pavelmakhanko]

There is no hardware offload setting on my device