=== STEP_034L PERSISTENT CANARY PLAN INSPECT === timestamp=20260708-122513 mode=read-only inspection + local plan package tunnel_ip=10.253.1.10 goal=decide safest persistence mechanism for runtime DSCP canary forbidden: remote file writes, firewall reload, network reload, wg reload, peer changes === VM100 OpenWrt/firewall persistence inspection === host_label=VM100 date=Wed Jul 8 12:25:14 UTC 2026 === openwrt release === DISTRIB_ID='OpenWrt' DISTRIB_RELEASE='24.10.2' DISTRIB_REVISION='r28739-d9340319c6' DISTRIB_TARGET='x86/64' DISTRIB_ARCH='x86_64' DISTRIB_DESCRIPTION='OpenWrt 24.10.2 r28739-d9340319c6' DISTRIB_TAINTS='' Linux OpenWrt 6.6.93 #0 SMP Mon Jun 23 20:40:36 2025 x86_64 GNU/Linux === installed firewall/nft packages === firewall4 - 2024.12.18~18fc0ead-r1 kmod-nft-core - 6.6.93-r1 kmod-nft-fib - 6.6.93-r1 kmod-nft-nat - 6.6.93-r1 kmod-nft-offload - 6.6.93-r1 kmod-wireguard - 6.6.93-r1 luci-app-firewall - 25.168.50434~d6b13f6 luci-proto-wireguard - 26.101.22949~8aafcdf nftables-json - 1.1.1-r1 wireguard-tools - 1.0.20210914-r4 === firewall service status === firewall_enabled_rc=0 active with no instances firewall_status_rc=0 === fw4 availability/check === fw4_exists_rc=0 fw4_check_rc=0 table inet fw4 { set pbr_transit_direct_4_dst_ip_user { type ipv4_addr flags interval auto-merge comment "" } } Ruleset passes nftables check. [!] Automatically including '/usr/share/nftables.d/ruleset-post/30-pbr.nft' === nftables.d / firewall.user inventory === drwxr-xr-x 2 root root 4096 May 27 10:40 . drwxr-xr-x 26 root root 4096 Jul 6 14:43 .. -rw-r--r-- 1 root root 1139 Jun 23 2025 10-custom-filter-chains.nft -rw-r--r-- 1 root root 222 May 27 10:40 90-wg-remote-snat-to-pc.nft -rw-r--r-- 1 root root 197 Jun 23 2025 README --- /etc/nftables.d/10-custom-filter-chains.nft --- ## The firewall4 input, forward and output chains are registered with ## priority `filter` (0). ## Uncomment the chains below if you want to stage rules *before* the ## default firewall input, forward and output chains. # chain user_pre_input { # type filter hook input priority -1; policy accept; # tcp dport ssh ct state new log prefix "SSH connection attempt: " # } # # chain user_pre_forward { # type filter hook forward priority -1; policy accept; # } # # chain user_pre_output { # type filter hook output priority -1; policy accept; # } ## Uncomment the chains below if you want to stage rules *after* the ## default firewall input, forward and output chains. # chain user_post_input { # type filter hook input priority 1; policy accept; # ct state new log prefix "Firewall4 accepted ingress: " # } # # chain user_post_forward { # type filter hook forward priority 1; policy accept; # ct state new log prefix "Firewall4 accepted forward: " # } # # chain user_post_output { # type filter hook output priority 1; policy accept; # ct state new log prefix "Firewall4 accepted egress: " # } --- /etc/nftables.d/90-wg-remote-snat-to-pc.nft --- chain wg_remote_snat_to_pc { type nat hook postrouting priority 99; policy accept; ip saddr 10.250.0.0/24 ip daddr 192.168.30.64 oifname "br-lan" counter snat ip to 192.168.30.1 comment "wg_remote_to_pc64_snat" } --- /etc/nftables.d/README --- All *.nft files in this directory are included by the firewall4 ruleset within the inet/fw4 table context which allows referencing named sets declared and populated by the firewall configuration. --- /etc/firewall.user --- NO_FIREWALL_USER_FILE=1 === firewall config includes === === fw4 generated include references === /usr/share/firewall4/main.uc:58: include("templates/ruleset.uc", { fw4, type, exists, length, include }); /usr/share/firewall4/main.uc:118:function run_includes() { /usr/share/firewall4/main.uc:122: for (let inc in state.includes) { /usr/share/firewall4/main.uc:129: `exec 1000>&-; config() { echo "You cannot use UCI in firewall includes!" >&2; exit 1; }; . '${path}'` /usr/share/firewall4/main.uc:157:case "includes": /usr/share/firewall4/main.uc:158: return run_includes(); /usr/share/firewall4/templates/redirect.uc:66: {%+ include("redirect.uc", { fw4, zone, redirect: { ...redirect, log: 0 } }) %} /usr/share/firewall4/templates/redirect.uc:69: {%+ include("redirect.uc", { fw4, zone, redirect: { ...redirect, log: 0 } }) %} /usr/share/firewall4/templates/rule.uc:74: {%+ include("rule.uc", { fw4, zone, rule: { ...rule, log: 0 } }) %} /usr/share/firewall4/templates/rule.uc:77: {%+ include("rule.uc", { fw4, zone, rule: { ...rule, log: 0 } }) %} /usr/share/firewall4/templates/ruleset.uc:13:{% fw4.includes('ruleset-prepend') %} /usr/share/firewall4/templates/ruleset.uc:101: # User includes /usr/share/firewall4/templates/ruleset.uc:104: include "/etc/nftables.d/*.nft" /usr/share/firewall4/templates/ruleset.uc:105:{% fw4.includes('table-prepend') %} /usr/share/firewall4/templates/ruleset.uc:117:{% fw4.includes('chain-prepend', 'input') %} /usr/share/firewall4/templates/ruleset.uc:123: {%+ include("rule.uc", { fw4, zone: null, rule }) %} /usr/share/firewall4/templates/ruleset.uc:126: {%+ include("zone-jump.uc", { fw4, zone, rule, direction: "input" }) %} /usr/share/firewall4/templates/ruleset.uc:131:{% fw4.includes('chain-append', 'input') %} /usr/share/firewall4/templates/ruleset.uc:140:{% fw4.includes('chain-prepend', 'forward') %} /usr/share/firewall4/templates/ruleset.uc:143: {%+ include("rule.uc", { fw4, zone: (rule.src?.zone?.log_limit ? rule.src.zone : rule.dest?.zone), rule }) %} /usr/share/firewall4/templates/ruleset.uc:146: {%+ include("zone-jump.uc", { fw4, zone, rule, direction: "forward" }) %} /usr/share/firewall4/templates/ruleset.uc:148:{% fw4.includes('chain-append', 'forward') %} /usr/share/firewall4/templates/ruleset.uc:159:{% fw4.includes('chain-prepend', 'output') %} /usr/share/firewall4/templates/ruleset.uc:162: {%+ include("rule.uc", { fw4, zone: null, rule }) %} /usr/share/firewall4/templates/ruleset.uc:170: {%+ include("zone-jump.uc", { fw4, zone, rule: { ...rule, devices_pos, subnets_pos }, direction: "helper" }) %} /usr/share/firewall4/templates/ruleset.uc:173: {%+ include("zone-jump.uc", { fw4, zone, rule, direction: "output" }) %} /usr/share/firewall4/templates/ruleset.uc:176:{% fw4.includes('chain-append', 'output') %} /usr/share/firewall4/templates/ruleset.uc:190: {%+ include("zone-jump.uc", { fw4, zone, rule: { ...rule, devices_pos, subnets_pos }, direction: "helper" }) %} /usr/share/firewall4/templates/ruleset.uc:223:{% fw4.includes('chain-prepend', `input_${zone.name}`) %} /usr/share/firewall4/templates/ruleset.uc:225: {%+ include("rule.uc", { fw4, zone, rule }) %} /usr/share/firewall4/templates/ruleset.uc:230:{% fw4.includes('chain-append', `input_${zone.name}`) %} /usr/share/firewall4/templates/ruleset.uc:235:{% fw4.includes('chain-prepend', `output_${zone.name}`) %} /usr/share/firewall4/templates/ruleset.uc:237: {%+ include("rule.uc", { fw4, zone, rule }) %} /usr/share/firewall4/templates/ruleset.uc:239:{% fw4.includes('chain-append', `output_${zone.name}`) %} /usr/share/firewall4/templates/ruleset.uc:244:{% fw4.includes('chain-prepend', `forward_${zone.name}`) %} /usr/share/firewall4/templates/ruleset.uc:246: {%+ include("rule.uc", { fw4, zone, rule }) %} /usr/share/firewall4/templates/ruleset.uc:251:{% fw4.includes('chain-append', `forward_${zone.name}`) %} /usr/share/firewall4/templates/ruleset.uc:262: {%+ include("rule.uc", { fw4, zone, rule }) %} /usr/share/firewall4/templates/ruleset.uc:271: {%+ include("zone-verdict.uc", { fw4, zone, rule, egress: false, verdict }) %} /usr/share/firewall4/templates/ruleset.uc:280: {%+ include("zone-drop-invalid.uc", { fw4, zone, rule }) %} /usr/share/firewall4/templates/ruleset.uc:282: {%+ include("zone-verdict.uc", { fw4, zone, rule, egress: true, verdict }) %} /usr/share/firewall4/templates/ruleset.uc:296:{% fw4.includes('chain-prepend', 'dstnat') %} /usr/share/firewall4/templates/ruleset.uc:300: {%+ include("zone-jump.uc", { fw4, zone, rule, direction: "dstnat" }) %} /usr/share/firewall4/templates/ruleset.uc:304:{% fw4.includes('chain-append', 'dstnat') %} /usr/share/firewall4/templates/ruleset.uc:309:{% fw4.includes('chain-prepend', 'srcnat') %} /usr/share/firewall4/templates/ruleset.uc:311: {%+ include("redirect.uc", { fw4, zone: null, redirect }) %} /usr/share/firewall4/templates/ruleset.uc:316: {%+ include("zone-jump.uc", { fw4, zone, rule, direction: "srcnat" }) %} /usr/share/firewall4/templates/ruleset.uc:320:{% fw4.includes('chain-append', 'srcnat') %} /usr/share/firewall4/templates/ruleset.uc:326:{% fw4.includes('chain-prepend', `dstnat_${zone.name}`) %} /usr/share/firewall4/templates/ruleset.uc:328: {%+ include("redirect.uc", { fw4, zone, redirect }) %} /usr/share/firewall4/templates/ruleset.uc:330:{% fw4.includes('chain-append', `dstnat_${zone.name}`) %} /usr/share/firewall4/templates/ruleset.uc:336:{% fw4.includes('chain-prepend', `srcnat_${zone.name}`) %} /usr/share/firewall4/templates/ruleset.uc:338: {%+ include("redirect.uc", { fw4, zone, redirect }) %} /usr/share/firewall4/templates/ruleset.uc:343: {%+ include("zone-masq.uc", { fw4, zone, family: 4, saddrs, daddrs }) %} /usr/share/firewall4/templates/ruleset.uc:350: {%+ include("zone-masq.uc", { fw4, zone, family: 6, saddrs, daddrs }) %} /usr/share/firewall4/templates/ruleset.uc:354:{% fw4.includes('chain-append', `srcnat_${zone.name}`) %} /usr/share/firewall4/templates/ruleset.uc:372: {%+ include("zone-jump.uc", { fw4, zone, rule: { ...rule, devices_pos, subnets_pos }, direction: "notrack" }) %} /usr/share/firewall4/templates/ruleset.uc:377:{% fw4.includes('chain-append', 'raw_prerouting') %} /usr/share/firewall4/templates/ruleset.uc:382:{% fw4.includes('chain-prepend', 'raw_output') %} /usr/share/firewall4/templates/ruleset.uc:389: {%+ include("zone-jump.uc", { fw4, zone, rule: { ...rule, devices_pos, subnets_pos }, direction: "notrack" }) %} /usr/share/firewall4/templates/ruleset.uc:394:{% fw4.includes('chain-append', 'raw_output') %} /usr/share/firewall4/templates/ruleset.uc:401: {%+ include("rule.uc", { fw4, zone, rule }) %} /usr/share/firewall4/templates/ruleset.uc:414:{% fw4.includes('chain-prepend', 'mangle_prerouting') %} /usr/share/firewall4/templates/ruleset.uc:416: {%+ include("rule.uc", { fw4, zone: null, rule }) %} /usr/share/firewall4/templates/ruleset.uc:418:{% fw4.includes('chain-append', 'mangle_prerouting') %} /usr/share/firewall4/templates/ruleset.uc:423:{% fw4.includes('chain-prepend', 'mangle_postrouting') %} /usr/share/firewall4/templates/ruleset.uc:425: {%+ include("rule.uc", { fw4, zone: null, rule }) %} /usr/share/firewall4/templates/ruleset.uc:430: {%+ include("zone-mssfix.uc", { fw4, zone, rule, egress: true }) %} /usr/share/firewall4/templates/ruleset.uc:434:{% fw4.includes('chain-append', 'mangle_postrouting') %} /usr/share/firewall4/templates/ruleset.uc:439:{% fw4.includes('chain-prepend', 'mangle_input') %} /usr/share/firewall4/templates/ruleset.uc:441: {%+ include("rule.uc", { fw4, zone: null, rule }) %} /usr/share/firewall4/templates/ruleset.uc:443:{% fw4.includes('chain-append', 'mangle_input') %} /usr/share/firewall4/templates/ruleset.uc:448:{% fw4.includes('chain-prepend', 'mangle_output') %} /usr/share/firewall4/templates/ruleset.uc:450: {%+ include("rule.uc", { fw4, zone: null, rule }) %} /usr/share/firewall4/templates/ruleset.uc:452:{% fw4.includes('chain-append', 'mangle_output') %} /usr/share/firewall4/templates/ruleset.uc:457:{% fw4.includes('chain-prepend', 'mangle_forward') %} /usr/share/firewall4/templates/ruleset.uc:459: {%+ include("rule.uc", { fw4, zone: null, rule }) %} /usr/share/firewall4/templates/ruleset.uc:464: {%+ include("zone-mssfix.uc", { fw4, zone, rule, egress: false }) %} /usr/share/firewall4/templates/ruleset.uc:468:{% fw4.includes('chain-append', 'mangle_forward') %} /usr/share/firewall4/templates/ruleset.uc:470:{% fw4.includes('table-append') %} /usr/share/firewall4/templates/ruleset.uc:472:{% fw4.includes('ruleset-append') %} /usr/share/firewall4/templates/zone-drop-invalid.uc:3:{%+ include("zone-match.uc", { egress: true, rule }) -%} /usr/share/firewall4/templates/zone-drop-invalid.uc:6: {%+ include("zone-drop-invalid.uc", { fw4, zone: { ...zone, log: 0 }, rule }) %} /usr/share/firewall4/templates/zone-jump.uc:3:{%+ include("zone-match.uc", { egress: (direction in ["output", "srcnat"]), rule }) -%} /usr/share/firewall4/templates/zone-mssfix.uc:3:{%+ include("zone-match.uc", { egress, rule }) -%} /usr/share/firewall4/templates/zone-verdict.uc:3:{%+ include("zone-match.uc", { egress, rule }) -%} /usr/share/firewall4/templates/zone-verdict.uc:6: {%+ include("zone-verdict.uc", { fw4, zone: { ...zone, log: 0 }, rule, egress, verdict }) %} /sbin/fw4:38: ACTION=includes \ === active canary nft runtime table === table inet wgpay_dscp_canary { chain prerouting { type filter hook prerouting priority mangle; policy accept; iifname "wg_paid" ip saddr 10.253.1.10 ip dscp set cs1 counter packets 4 bytes 336 comment "STEP_034I_WGPAY_CANARY_DSCP_CS1" } } === current UCI changes === === safety proof === no_remote_file_write=1 no_firewall_reload=1 no_network_reload=1 no_wg_reload=1 no_peer_change=1 VM100_inspect_done=1 === VM101 OpenWrt/firewall persistence inspection === host_label=VM101 date=Wed Jul 8 12:25:15 UTC 2026 === openwrt release === DISTRIB_ID='OpenWrt' DISTRIB_RELEASE='24.10.2' DISTRIB_REVISION='r28739-d9340319c6' DISTRIB_TARGET='x86/64' DISTRIB_ARCH='x86_64' DISTRIB_DESCRIPTION='OpenWrt 24.10.2 r28739-d9340319c6' DISTRIB_TAINTS='' Linux OpenWrt 6.6.93 #0 SMP Mon Jun 23 20:40:36 2025 x86_64 GNU/Linux === installed firewall/nft packages === firewall4 - 2024.12.18~18fc0ead-r1 kmod-nft-core - 6.6.93-r1 kmod-nft-fib - 6.6.93-r1 kmod-nft-nat - 6.6.93-r1 kmod-nft-offload - 6.6.93-r1 kmod-wireguard - 6.6.93-r1 luci-app-firewall - 25.168.50434~d6b13f6 luci-proto-wireguard - 26.101.22949~8aafcdf nftables-json - 1.1.1-r1 wireguard-tools - 1.0.20210914-r4 === firewall service status === firewall_enabled_rc=0 active with no instances firewall_status_rc=0 === fw4 availability/check === fw4_exists_rc=0 fw4_check_rc=0 Ruleset passes nftables check. === nftables.d / firewall.user inventory === drwxr-xr-x 2 root root 4096 May 24 16:48 . drwxr-xr-x 25 root root 4096 May 17 09:31 .. -rw-r--r-- 1 root root 1139 Jun 23 2025 10-custom-filter-chains.nft -rw-r--r-- 1 root root 219 May 24 16:48 90-wg-guest-snat.nft -rw-r--r-- 1 root root 197 Jun 23 2025 README --- /etc/nftables.d/10-custom-filter-chains.nft --- ## The firewall4 input, forward and output chains are registered with ## priority `filter` (0). ## Uncomment the chains below if you want to stage rules *before* the ## default firewall input, forward and output chains. # chain user_pre_input { # type filter hook input priority -1; policy accept; # tcp dport ssh ct state new log prefix "SSH connection attempt: " # } # # chain user_pre_forward { # type filter hook forward priority -1; policy accept; # } # # chain user_pre_output { # type filter hook output priority -1; policy accept; # } ## Uncomment the chains below if you want to stage rules *after* the ## default firewall input, forward and output chains. # chain user_post_input { # type filter hook input priority 1; policy accept; # ct state new log prefix "Firewall4 accepted ingress: " # } # # chain user_post_forward { # type filter hook forward priority 1; policy accept; # ct state new log prefix "Firewall4 accepted forward: " # } # # chain user_post_output { # type filter hook output priority 1; policy accept; # ct state new log prefix "Firewall4 accepted egress: " # } --- /etc/nftables.d/90-wg-guest-snat.nft --- chain wg_guest_snat { type nat hook postrouting priority 99; policy accept; iifname "eth0" oifname "eth2" ip daddr 192.168.30.189 udp dport 51821 counter snat ip to 192.168.30.2 comment "WG_GUEST_51821_SNAT" } --- /etc/nftables.d/README --- All *.nft files in this directory are included by the firewall4 ruleset within the inet/fw4 table context which allows referencing named sets declared and populated by the firewall configuration. --- /etc/firewall.user --- NO_FIREWALL_USER_FILE=1 === firewall config includes === firewall.@rule[1].icmp_type='echo-request' firewall.@rule[4].icmp_type='130/0' '131/0' '132/0' '143/0' firewall.@rule[5].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type' 'router-solicitation' 'neighbour-solicitation' 'router-advertisement' 'neighbour-advertisement' firewall.@rule[6].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type' firewall.@rule[7].icmp_type='echo-request' === fw4 generated include references === /usr/share/firewall4/main.uc:58: include("templates/ruleset.uc", { fw4, type, exists, length, include }); /usr/share/firewall4/main.uc:118:function run_includes() { /usr/share/firewall4/main.uc:122: for (let inc in state.includes) { /usr/share/firewall4/main.uc:129: `exec 1000>&-; config() { echo "You cannot use UCI in firewall includes!" >&2; exit 1; }; . '${path}'` /usr/share/firewall4/main.uc:157:case "includes": /usr/share/firewall4/main.uc:158: return run_includes(); /usr/share/firewall4/templates/redirect.uc:66: {%+ include("redirect.uc", { fw4, zone, redirect: { ...redirect, log: 0 } }) %} /usr/share/firewall4/templates/redirect.uc:69: {%+ include("redirect.uc", { fw4, zone, redirect: { ...redirect, log: 0 } }) %} /usr/share/firewall4/templates/rule.uc:74: {%+ include("rule.uc", { fw4, zone, rule: { ...rule, log: 0 } }) %} /usr/share/firewall4/templates/rule.uc:77: {%+ include("rule.uc", { fw4, zone, rule: { ...rule, log: 0 } }) %} /usr/share/firewall4/templates/ruleset.uc:13:{% fw4.includes('ruleset-prepend') %} /usr/share/firewall4/templates/ruleset.uc:101: # User includes /usr/share/firewall4/templates/ruleset.uc:104: include "/etc/nftables.d/*.nft" /usr/share/firewall4/templates/ruleset.uc:105:{% fw4.includes('table-prepend') %} /usr/share/firewall4/templates/ruleset.uc:117:{% fw4.includes('chain-prepend', 'input') %} /usr/share/firewall4/templates/ruleset.uc:123: {%+ include("rule.uc", { fw4, zone: null, rule }) %} /usr/share/firewall4/templates/ruleset.uc:126: {%+ include("zone-jump.uc", { fw4, zone, rule, direction: "input" }) %} /usr/share/firewall4/templates/ruleset.uc:131:{% fw4.includes('chain-append', 'input') %} /usr/share/firewall4/templates/ruleset.uc:140:{% fw4.includes('chain-prepend', 'forward') %} /usr/share/firewall4/templates/ruleset.uc:143: {%+ include("rule.uc", { fw4, zone: (rule.src?.zone?.log_limit ? rule.src.zone : rule.dest?.zone), rule }) %} /usr/share/firewall4/templates/ruleset.uc:146: {%+ include("zone-jump.uc", { fw4, zone, rule, direction: "forward" }) %} /usr/share/firewall4/templates/ruleset.uc:148:{% fw4.includes('chain-append', 'forward') %} /usr/share/firewall4/templates/ruleset.uc:159:{% fw4.includes('chain-prepend', 'output') %} /usr/share/firewall4/templates/ruleset.uc:162: {%+ include("rule.uc", { fw4, zone: null, rule }) %} /usr/share/firewall4/templates/ruleset.uc:170: {%+ include("zone-jump.uc", { fw4, zone, rule: { ...rule, devices_pos, subnets_pos }, direction: "helper" }) %} /usr/share/firewall4/templates/ruleset.uc:173: {%+ include("zone-jump.uc", { fw4, zone, rule, direction: "output" }) %} /usr/share/firewall4/templates/ruleset.uc:176:{% fw4.includes('chain-append', 'output') %} /usr/share/firewall4/templates/ruleset.uc:190: {%+ include("zone-jump.uc", { fw4, zone, rule: { ...rule, devices_pos, subnets_pos }, direction: "helper" }) %} /usr/share/firewall4/templates/ruleset.uc:223:{% fw4.includes('chain-prepend', `input_${zone.name}`) %} /usr/share/firewall4/templates/ruleset.uc:225: {%+ include("rule.uc", { fw4, zone, rule }) %} /usr/share/firewall4/templates/ruleset.uc:230:{% fw4.includes('chain-append', `input_${zone.name}`) %} /usr/share/firewall4/templates/ruleset.uc:235:{% fw4.includes('chain-prepend', `output_${zone.name}`) %} /usr/share/firewall4/templates/ruleset.uc:237: {%+ include("rule.uc", { fw4, zone, rule }) %} /usr/share/firewall4/templates/ruleset.uc:239:{% fw4.includes('chain-append', `output_${zone.name}`) %} /usr/share/firewall4/templates/ruleset.uc:244:{% fw4.includes('chain-prepend', `forward_${zone.name}`) %} /usr/share/firewall4/templates/ruleset.uc:246: {%+ include("rule.uc", { fw4, zone, rule }) %} /usr/share/firewall4/templates/ruleset.uc:251:{% fw4.includes('chain-append', `forward_${zone.name}`) %} /usr/share/firewall4/templates/ruleset.uc:262: {%+ include("rule.uc", { fw4, zone, rule }) %} /usr/share/firewall4/templates/ruleset.uc:271: {%+ include("zone-verdict.uc", { fw4, zone, rule, egress: false, verdict }) %} /usr/share/firewall4/templates/ruleset.uc:280: {%+ include("zone-drop-invalid.uc", { fw4, zone, rule }) %} /usr/share/firewall4/templates/ruleset.uc:282: {%+ include("zone-verdict.uc", { fw4, zone, rule, egress: true, verdict }) %} /usr/share/firewall4/templates/ruleset.uc:296:{% fw4.includes('chain-prepend', 'dstnat') %} /usr/share/firewall4/templates/ruleset.uc:300: {%+ include("zone-jump.uc", { fw4, zone, rule, direction: "dstnat" }) %} /usr/share/firewall4/templates/ruleset.uc:304:{% fw4.includes('chain-append', 'dstnat') %} /usr/share/firewall4/templates/ruleset.uc:309:{% fw4.includes('chain-prepend', 'srcnat') %} /usr/share/firewall4/templates/ruleset.uc:311: {%+ include("redirect.uc", { fw4, zone: null, redirect }) %} /usr/share/firewall4/templates/ruleset.uc:316: {%+ include("zone-jump.uc", { fw4, zone, rule, direction: "srcnat" }) %} /usr/share/firewall4/templates/ruleset.uc:320:{% fw4.includes('chain-append', 'srcnat') %} /usr/share/firewall4/templates/ruleset.uc:326:{% fw4.includes('chain-prepend', `dstnat_${zone.name}`) %} /usr/share/firewall4/templates/ruleset.uc:328: {%+ include("redirect.uc", { fw4, zone, redirect }) %} /usr/share/firewall4/templates/ruleset.uc:330:{% fw4.includes('chain-append', `dstnat_${zone.name}`) %} /usr/share/firewall4/templates/ruleset.uc:336:{% fw4.includes('chain-prepend', `srcnat_${zone.name}`) %} /usr/share/firewall4/templates/ruleset.uc:338: {%+ include("redirect.uc", { fw4, zone, redirect }) %} /usr/share/firewall4/templates/ruleset.uc:343: {%+ include("zone-masq.uc", { fw4, zone, family: 4, saddrs, daddrs }) %} /usr/share/firewall4/templates/ruleset.uc:350: {%+ include("zone-masq.uc", { fw4, zone, family: 6, saddrs, daddrs }) %} /usr/share/firewall4/templates/ruleset.uc:354:{% fw4.includes('chain-append', `srcnat_${zone.name}`) %} /usr/share/firewall4/templates/ruleset.uc:372: {%+ include("zone-jump.uc", { fw4, zone, rule: { ...rule, devices_pos, subnets_pos }, direction: "notrack" }) %} /usr/share/firewall4/templates/ruleset.uc:377:{% fw4.includes('chain-append', 'raw_prerouting') %} /usr/share/firewall4/templates/ruleset.uc:382:{% fw4.includes('chain-prepend', 'raw_output') %} /usr/share/firewall4/templates/ruleset.uc:389: {%+ include("zone-jump.uc", { fw4, zone, rule: { ...rule, devices_pos, subnets_pos }, direction: "notrack" }) %} /usr/share/firewall4/templates/ruleset.uc:394:{% fw4.includes('chain-append', 'raw_output') %} /usr/share/firewall4/templates/ruleset.uc:401: {%+ include("rule.uc", { fw4, zone, rule }) %} /usr/share/firewall4/templates/ruleset.uc:414:{% fw4.includes('chain-prepend', 'mangle_prerouting') %} /usr/share/firewall4/templates/ruleset.uc:416: {%+ include("rule.uc", { fw4, zone: null, rule }) %} /usr/share/firewall4/templates/ruleset.uc:418:{% fw4.includes('chain-append', 'mangle_prerouting') %} /usr/share/firewall4/templates/ruleset.uc:423:{% fw4.includes('chain-prepend', 'mangle_postrouting') %} /usr/share/firewall4/templates/ruleset.uc:425: {%+ include("rule.uc", { fw4, zone: null, rule }) %} /usr/share/firewall4/templates/ruleset.uc:430: {%+ include("zone-mssfix.uc", { fw4, zone, rule, egress: true }) %} /usr/share/firewall4/templates/ruleset.uc:434:{% fw4.includes('chain-append', 'mangle_postrouting') %} /usr/share/firewall4/templates/ruleset.uc:439:{% fw4.includes('chain-prepend', 'mangle_input') %} /usr/share/firewall4/templates/ruleset.uc:441: {%+ include("rule.uc", { fw4, zone: null, rule }) %} /usr/share/firewall4/templates/ruleset.uc:443:{% fw4.includes('chain-append', 'mangle_input') %} /usr/share/firewall4/templates/ruleset.uc:448:{% fw4.includes('chain-prepend', 'mangle_output') %} /usr/share/firewall4/templates/ruleset.uc:450: {%+ include("rule.uc", { fw4, zone: null, rule }) %} /usr/share/firewall4/templates/ruleset.uc:452:{% fw4.includes('chain-append', 'mangle_output') %} /usr/share/firewall4/templates/ruleset.uc:457:{% fw4.includes('chain-prepend', 'mangle_forward') %} /usr/share/firewall4/templates/ruleset.uc:459: {%+ include("rule.uc", { fw4, zone: null, rule }) %} /usr/share/firewall4/templates/ruleset.uc:464: {%+ include("zone-mssfix.uc", { fw4, zone, rule, egress: false }) %} /usr/share/firewall4/templates/ruleset.uc:468:{% fw4.includes('chain-append', 'mangle_forward') %} /usr/share/firewall4/templates/ruleset.uc:470:{% fw4.includes('table-append') %} /usr/share/firewall4/templates/ruleset.uc:472:{% fw4.includes('ruleset-append') %} /usr/share/firewall4/templates/zone-drop-invalid.uc:3:{%+ include("zone-match.uc", { egress: true, rule }) -%} /usr/share/firewall4/templates/zone-drop-invalid.uc:6: {%+ include("zone-drop-invalid.uc", { fw4, zone: { ...zone, log: 0 }, rule }) %} /usr/share/firewall4/templates/zone-jump.uc:3:{%+ include("zone-match.uc", { egress: (direction in ["output", "srcnat"]), rule }) -%} /usr/share/firewall4/templates/zone-mssfix.uc:3:{%+ include("zone-match.uc", { egress, rule }) -%} /usr/share/firewall4/templates/zone-verdict.uc:3:{%+ include("zone-match.uc", { egress, rule }) -%} /usr/share/firewall4/templates/zone-verdict.uc:6: {%+ include("zone-verdict.uc", { fw4, zone: { ...zone, log: 0 }, rule, egress, verdict }) %} /sbin/fw4:38: ACTION=includes \ === active canary nft runtime table === table inet router_egress_dscp_canary { chain prerouting { type filter hook prerouting priority mangle; policy accept; iifname "eth1" ip saddr 10.200.0.1 ip dscp cs1 meta mark set 0x00000203 counter packets 4 bytes 336 comment "STEP_034I_DSCP_CS1_TO_FW_MARK_0x203" } chain postrouting { type filter hook postrouting priority mangle; policy accept; meta mark 0x00000203 ip dscp cs1 ip dscp set cs0 counter packets 4 bytes 336 comment "STEP_034I_CLEAR_DSCP_ON_MARKED_EGRESS" } } === current UCI changes === === safety proof === no_remote_file_write=1 no_firewall_reload=1 no_network_reload=1 no_wg_reload=1 no_peer_change=1 VM101_inspect_done=1 === STEP_034L RESULT === vm100_inspect_done_lines=1 vm101_inspect_done_lines=1 fw4_exists_lines=2 fw4_check_ok_lines=2 nftables_d_related_lines=11 firewall_user_related_lines=4 uci_change_related_lines=0 package=/opt/router-ops/apply-packages/20260708-122513_step034l_persistent_canary_plan_inspect decision=PASS_PERSISTENT_CANARY_PLAN_INSPECT