Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

NDS 5.0.2 on OpenWrt 22.03: iptables-nft translation strips port matchers — pre-auth DNAT hijacks all TCP (not just :80)

Open
  • Is something wrong?
#398 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
38/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
bash, go, linux
Domain
infrastructure, networking, security

Research direction

Start from the OpenWrt packaging that ships NDS and the 20-nds-enforce.nft include (mentioned as hooking inet fw4 forward). Confirm how NDS 5.0.2 inserts iptables-nft rules on 22.03 versus 24.10, and where a version check or chain flush would live. Done means 22.03 is documented as unsupported and/or packaging flushes broken nds* chains so pre-auth TCP is not hijacked; this needs OpenWrt/nftables familiarity, not a one-file Go edit.

Written by the indexing model from the issue text.

Description

Environment

  • OpenWrt 22.03.3 (x86/64), mac80211_hwsim virtual radios
  • nodogsplash 5.0.2 (from 22.03 opkg feed)
  • tollgate-wrt v0.6.0-alpha1-lab (main@373770a)

Bug

NDS 5.0.2 on OpenWrt 22.03 inserts its firewall rules via iptables-nft. The translation to nftables strips the port match expressions from every TCP rule, leaving # xt_tcp comment markers:

chain ndsRTR {
    meta l4proto tcp # xt_tcp counter packets 0 bytes 0 drop
    meta l4proto tcp # xt_tcp counter packets 0 bytes 0 accept
    ...
}
chain ndsOUT {
    meta l4proto tcp # xt_tcp counter packets 4 bytes 240 # xt_DNAT
}
Consequences:
  1. ndsOUT (NAT PREROUTING): the DNAT rule has no port matcher → redirects ALL TCP from pre-auth clients, not just :80. Clients connecting to :2121 (the tollgate API) or :2051 (the portal SPA) get silently DNAT'd to NDS's internal gateway → blank page / hang.
  2. ndsRTR (INPUT): the port-specific allow rules (22, 53, 80, 2050, 2051, 2121) are dead — the meta l4proto tcp matches all TCP but the port discriminator is gone. Pre-auth clients can't reach the router on ANY TCP port.
Reproduction:
  1. Install NDS 5.0.2 on OpenWrt 22.03
  2. Start it on a bridge interface with clients
  3. From a pre-auth client, try to reach any router TCP port (e.g. :2121)
  4. Connection hangs or gets blank response (DNAT'd to NDS)
  5. Run nft list chain ip nat ndsOUT — observe # xt_tcp where port matchers should be
Why it works on 24.10:

The 20-nds-enforce.nft include in the tollgate packaging hooks into inet fw4 forward at priority -1, which solves a DIFFERENT problem (fw4 accepting before NDS sees packets). On 22.03, the problem is earlier in the pipeline — the iptables-nft translation itself is broken, so NDS's rules never function correctly regardless of the enforcement hook.

Workaround (for testing on 22.03):

Flush all NDS-inserted chains and write explicit nftables rules:

for T in ip filter ip nat ip mangle; do
  for C in $(nft list table $T | grep "chain nds" | sed "s/.*chain \([^ ]*\).*/\1/"); do
    nft flush chain $T $C
  done
done
echo f > /proc/net/nf_conntrack  # clear stale DNAT entries
Recommendation:
  • Document 22.03 as unsupported (or add a version check to the packaging)
  • The 20-nds-enforce.nft include should also flush NDS's broken iptables-nft chains on 22.03, not just add the fw4 hook
Dominant language
Go
Stars
12
Forks
14
Avg merge
1d 5h
Merged PRs (30d)
246

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from OpenTollGate/tollgate-module-basic-go

All issues in OpenTollGate/tollgate-module-basic-go

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.