https-dns-proxy: break firewall

[artemklevtsov]

Package Name

https-dns-proxy

Maintainer

Stan Grishin stangri@melmac.ca

OpenWrt Version

25.12.2

OpenWrt Target/Subtarget

mediatek/filogic

Steps to Reproduce

apk add https-dns-proxy
fw4 reload

Actual Behaviour

# fw4 reload
Automatically including '/usr/share/nftables.d/ruleset-post/20-https-dns-proxy-notrack.nft'
In file included from /dev/stdin:202:1-76:
/usr/share/nftables.d/ruleset-post/20-https-dns-proxy-notrack.nft:1:34-34: Error: syntax error, unexpected '{', expecting string or last
chain raw_output_https_dns_proxy {
                                 ^
In file included from /dev/stdin:202:1-76:
/usr/share/nftables.d/ruleset-post/20-https-dns-proxy-notrack.nft:2:1-4: Error: syntax error, unexpected type
type filter hook output priority raw; policy accept;
^^^^
In file included from /dev/stdin:202:1-76:
/usr/share/nftables.d/ruleset-post/20-https-dns-proxy-notrack.nft:2:39-44: Error: syntax error, unexpected policy
type filter hook output priority raw; policy accept;
                                      ^^^^^^
In file included from /dev/stdin:202:1-76:
/usr/share/nftables.d/ruleset-post/20-https-dns-proxy-notrack.nft:3:1-4: Error: syntax error, unexpected meta
meta l4proto { tcp, udp } th dport { 5053, 5054 } ip daddr 127.0.0.0/8 notrack
^^^^
In file included from /dev/stdin:202:1-76:
/usr/share/nftables.d/ruleset-post/20-https-dns-proxy-notrack.nft:4:1-4: Error: syntax error, unexpected meta
meta l4proto { tcp, udp } th sport { 5053, 5054 } ip saddr 127.0.0.0/8 notrack
^^^^
In file included from /dev/stdin:202:1-76:
/usr/share/nftables.d/ruleset-post/20-https-dns-proxy-notrack.nft:5:1-1: Error: syntax error, unexpected '}'
}
^

Confirmation Checklist

• The package is maintained in this repository.
• I understand that issues related to the base OpenWrt repository or LuCI repository will be closed.
• I am reporting an issue for OpenWrt, not an unsupported fork.

[artemklevtsov]

Also on fresh system:

# apk add luci-app-https-dns-proxy
(1/7) Installing libcares (1.34.6-r1)
  Executing libcares-1.34.6-r1.post-install
(2/7) Installing libnghttp2-14 (1.66.0-r1)
  Executing libnghttp2-14-1.66.0-r1.post-install
(3/7) Installing libcurl4 (8.19.0-r1)
  Executing libcurl4-8.19.0-r1.post-install
(4/7) Installing libev (4.33-r2)
  Executing libev-4.33-r2.post-install
(5/7) Installing resolveip (2)
  Executing resolveip-2.post-install
(6/7) Installing https-dns-proxy (2025.12.29-r5)
  Executing https-dns-proxy-2025.12.29-r5.post-install
  * /etc/rc.common: line 157: can't create /usr/share/nftables.d/ruleset-post/20-https-dns-proxy-notrack.nft: nonexistent directory
(7/7) Installing luci-app-https-dns-proxy (2025.12.29-r5)
  Executing luci-app-https-dns-proxy-2025.12.29-r5.post-install

[artemklevtsov]

/usr/share/nftables.d/ruleset-post/20-https-dns-proxy-notrack.nft seems should be

table inet fw4 {
chain raw_output_https_dns_proxy {
type filter hook output priority raw; policy accept;
meta l4proto { tcp, udp } th dport { 5053, 5054 } ip daddr 127.0.0.0/8 notrack
meta l4proto { tcp, udp } th sport { 5053, 5054 } ip saddr 127.0.0.0/8 notrack
}
}

[brada4]

Since this commit from @stangri and @commodo

ebe149b
(week ago)

As a workaround you can disable notrack_dns
AND ;-)
You can safely notrack all loopback traffic. It is allowed, nat or forward not possible, thus conntrack is just waste of resources, or extracting payload 2x for that sake.

[dimberr]

Can confirm on ramips/mt7621 (D-Link DIR-878), OpenWrt 25.12.2 r32802-f505120278.

Two issues with this feature:

1. Missing ruleset-post/ directory

The directory /usr/share/nftables.d/ruleset-post/ does not exist by default on at least some targets. The post-upgrade script runs immediately and tries to write the .nft file before the directory exists, producing:

* /etc/rc.common: line 157: can't create /usr/share/nftables.d/ruleset-post/20-https-dns-proxy-notrack.nft: nonexistent directory

The init script (or Makefile install step) should mkdir -p the directory before attempting to write the file.

2. Root cause of the syntax error

The generated file is missing a table inet fw4 { } wrapper. Files under ruleset-post/ are included inline into fw4's rendered script, which already has an outer table context — so a bare chain declaration at the top level is invalid.

The bug is in the notrack_nft update heredoc in files/etc/init.d/https-dns-proxy (commit ebe149b, diff lines +147–+154). The fix is to wrap the generated content:

table inet fw4 {
    chain raw_output_https_dns_proxy {
        type filter hook output priority raw; policy accept;
        meta l4proto { tcp, udp } th dport { ${port_set} } ip daddr 127.0.0.0/8 notrack
        meta l4proto { tcp, udp } th sport { ${port_set} } ip saddr 127.0.0.0/8 notrack
    }
}

Workaround (until a fix is released):

mkdir -p /usr/share/nftables.d/ruleset-post/
cat > /usr/share/nftables.d/ruleset-post/20-https-dns-proxy-notrack.nft << 'EOF'
table inet fw4 {
    chain raw_output_https_dns_proxy {
        type filter hook output priority raw; policy accept;
        meta l4proto { tcp, udp } th dport { 5053 } ip daddr 127.0.0.0/8 notrack
        meta l4proto { tcp, udp } th sport { 5053 } ip saddr 127.0.0.0/8 notrack
    }
}
EOF
fw4 reload

Note: the workaround is overwritten on every https-dns-proxy restart since the init script regenerates the file from the broken heredoc. Users who want to avoid the issue entirely until a fix lands can set option notrack_dns '0' in /etc/config/https-dns-proxy.

[brada4]

More elegant to prepend to existing chains via /etc/nftables.d/whatever.nft

chain raw_prerouting {    
  type filter hook prerouting priority raw;
  iif "lo" notrack return
}
chain raw_output {   
  type filter hook output priority raw;       
oif "lo" notrack return
}

[brada4]

PS Sorry about formatting, it is via mobile

File is backed up over sysupgrades and nobody overwrites it.

[artemklevtsov]

/usr/share/nftables.d/ruleset-post/20-https-dns-proxy-notrack.nft is recreated after the service is restarted. I edited the init.d script until the fix came out.

[brada4]

Just disable broken option and untrack loopback forever.....
Cannot expressi in words how wrong that rule is.... keyword : ipv6

[brada4]

edited the init.d scrip

You can place chains with rules in /etc/nftables.d/*.nft

[egc112]

Thanks for reporting, I also experienced this problem two days ago and discussed it with the maintainer and a patch was committed today see also for the workaround:
https://forum.openwrt.org/t/policy-based-routing-pbr-package-discussion/140639/2781?u=egc

[brada4]

@egc112 not for lack of trying ... .openwrt/firewall4#4

[egc112]

@egc112 not for lack of trying ... .openwrt/firewall4#4

Yes, the idea itself was not rejected but the devs could not oversee all the consequences. I can sort of understand that

But anyway your idea has resurfaced on a smaller scale and is now configurable :)

Any comments on the actual rules which are used?