AVM FRITZ!Box 7530 (IPQ4019)

[francisuk1989]

I am currently running 1.15.X Built 20260613-1323.

It would be highly beneficial to include an option for WAN using the LAN1 port, This would properly support users on Cable or FTTH who connect via an ONT.

To achieve this /etc/config/network this would be;

config device 'brlan_dev'
option name 'br-lan'
option type 'bridge'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'

config interface 'wan'
option device 'lan1'
option proto 'dhcp'
option ipv6 '0'
option dns '1.1.1.1'
option peerdns '0'

Issue with QoS (Download) Service Classes only, Dos not affect the Uplink/Upload QoS.

Im having an issue with my QoS Download Service Classes. I've set up 4 download classes and assigned 'Bulk' as the "Default Service Class" However, when I create a specific rule to assign my computer to the 'High' priority class, the router ignores it. Instead of putting my computer in 'High', it just defaults it to the "Default Service Class".

fixed

Code: Select all

https://www.gargoyle-router.com/phpbb/viewtopic.php?p=67990#p67990

[Lantis]

Thanks for the feature suggestion, it's not something I'm likely to add here but I'll look at it in another space.
If you are maintaining your own builds, I would create a new patches-generic which patches the file target/linux/ipq40xx/base-files/etc/board.d/02_network, Line 67

Code: Select all

 		ucidef_set_interface_lan "lan"
 		;;
 	avm,fritzbox-7530)
-		ucidef_set_interface_lan "lan1 lan2 lan3 lan4"
+		ucidef_set_interface_lan_wan "lan2 lan3 lan4" "lan1"
 		;;
 	avm,fritzrepeater-3000|\
 	cellc,rtl30vw)

Pretty sure that will just work.

Can you show your /etc/config/qos_gargoyle please?
A full output of "nft list ruleset" would also be useful.
Do you also have any quotas applying to the network or the device?

[francisuk1989]

If you are maintaining your own builds, I would create a new patches-generic which patches the file

I am currently using your build under the ipq40xx.
Here was my network config for openwrt 25.12.x what looks to be the same as 24.10.x
https://justpaste.it/efkuz

Can you show your /etc/config/qos_gargoyle please?
A full output of "nft list ruleset" would also be useful.

Code: Select all

root@fritz:~# cat /etc/config/qos_gargoyle

config upload 'upload'
	option default_class 'uclass_2'

config download 'download'
	option default_class 'dclass_4'
	option total_bandwidth '20480'

config upload_class 'uclass_1'
	option name 'Fast'
	option percent_bandwidth '90'

config upload_class 'uclass_2'
	option name 'Normal'
	option percent_bandwidth '10'

config upload_rule 'upload_rule_100'
	option class 'uclass_1'
	option test_order '100'
	option family 'any'
	option max_pkt_size '128'

config upload_rule 'upload_rule_200'
	option class 'uclass_1'
	option test_order '200'
	option family 'ipv4'
	option source '192.168.1.3'
	option dstport '1000-63365'
	option max_pkt_size '160'
	option proto 'udp'

config download_class 'dclass_1'
	option name 'High'
	option percent_bandwidth '83'

config download_class 'dclass_2'
	option name 'Medium'
	option percent_bandwidth '15'

config download_class 'dclass_3'
	option name 'Gaming'
	option percent_bandwidth '1'

config download_class 'dclass_4'
	option name 'Bulk'
	option percent_bandwidth '1'

config download_rule 'download_rule_100'
	option class 'dclass_1'
	option test_order '100'
	option family 'ipv4'
	option source '192.168.1.2'

and nftables

Code: Select all

root@fritz:~# nft list ruleset
table inet fw4 {
	ct helper amanda {
		type "amanda" protocol udp
		l3proto inet
	}

	ct helper ftp {
		type "ftp" protocol tcp
		l3proto inet
	}

	ct helper RAS {
		type "RAS" protocol udp
		l3proto inet
	}

	ct helper Q.931 {
		type "Q.931" protocol tcp
		l3proto inet
	}

	ct helper irc {
		type "irc" protocol tcp
		l3proto ip
	}

	ct helper netbios-ns {
		type "netbios-ns" protocol udp
		l3proto ip
	}

	ct helper pptp {
		type "pptp" protocol tcp
		l3proto ip
	}

	ct helper sane {
		type "sane" protocol tcp
		l3proto inet
	}

	ct helper sip {
		type "sip" protocol udp
		l3proto inet
	}

	ct helper snmp {
		type "snmp" protocol udp
		l3proto ip
	}

	ct helper tftp {
		type "tftp" protocol udp
		l3proto inet
	}

	map lease_mismatch_pairs {
		type ipv4_addr . ether_addr : verdict
		elements = { 192.168.1.2 . 6c:0b:84:a9:ac:b0 : return }
	}

	set lease_mismatch_ips {
		type ipv4_addr
		elements = { 192.168.1.2 }
	}

	set lease_mismatch_macs {
		type ether_addr
		elements = { 6c:0b:84:a9:ac:b0 }
	}

	chain input {
		type filter hook input priority filter; policy drop;
		jump input_rule comment "!fw4: Custom input rule chain"
		iif "lo" accept comment "!fw4: Accept traffic from loopback"
		ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
		tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "!fw4: Rate limit TCP syn packets"
		iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
		iifname "lan1" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
		jump handle_reject
	}

	chain forward {
		type filter hook forward priority filter; policy drop;
		iifname "lan1" jump ingress_restrictions
		oifname "lan1" jump egress_restrictions
		jump forward_rule comment "!fw4: Custom forward rule chain"
		ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows"
		iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
		iifname "lan1" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
		jump handle_reject
	}

	chain output {
		type filter hook output priority filter; policy accept;
		jump output_rule comment "!fw4: Custom output rule chain"
		oif "lo" accept comment "!fw4: Accept traffic towards loopback"
		ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
		oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
		oifname "lan1" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
	}

	chain prerouting {
		type filter hook prerouting priority filter; policy accept;
		jump prerouting_rule comment "!fw4: Custom prerouting rule chain"
		iifname "br-lan" jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment"
	}

	chain handle_reject {
		meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
		reject comment "!fw4: Reject any other traffic"
	}

	chain syn_flood {
		limit rate 25/second burst 50 packets return comment "!fw4: Accept SYN packets below rate-limit"
		drop comment "!fw4: Drop excess packets"
	}

	chain input_lan {
		jump input_lan_rule comment "!fw4: Custom input_lan rule chain"
		ct status dnat accept comment "!fw4: Accept port redirections"
		jump accept_from_lan
	}

	chain output_lan {
		jump output_lan_rule comment "!fw4: Custom output_lan rule chain"
		jump accept_to_lan
	}

	chain forward_lan {
		jump pf_loopback_B
		iifname "br-lan" oifname "br-lan" accept
		jump forward_lan_rule comment "!fw4: Custom forward_lan rule chain"
		jump accept_to_wan comment "!fw4: Accept lan to wan forwarding"
		ct status dnat accept comment "!fw4: Accept port forwards"
		jump accept_to_lan
	}

	chain helper_lan {
		udp dport 10080 ct helper set "amanda" comment "!fw4: Amanda backup and archiving proto"
		tcp dport 21 ct helper set "ftp" comment "!fw4: FTP passive connection tracking"
		udp dport 1719 ct helper set "RAS" comment "!fw4: RAS proto tracking"
		tcp dport 1720 ct helper set "Q.931" comment "!fw4: Q.931 proto tracking"
		meta nfproto ipv4 tcp dport 6667 ct helper set "irc" comment "!fw4: IRC DCC connection tracking"
		meta nfproto ipv4 udp dport 137 ct helper set "netbios-ns" comment "!fw4: NetBIOS name service broadcast tracking"
		meta nfproto ipv4 tcp dport 1723 ct helper set "pptp" comment "!fw4: PPTP VPN connection tracking"
		tcp dport 6566 ct helper set "sane" comment "!fw4: SANE scanner connection tracking"
		udp dport 5060 ct helper set "sip" comment "!fw4: SIP VoIP connection tracking"
		meta nfproto ipv4 udp dport 161 ct helper set "snmp" comment "!fw4: SNMP monitoring connection tracking"
		udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
	}

	chain accept_from_lan {
		iifname "br-lan" counter packets 22858 bytes 13031848 accept comment "!fw4: accept lan IPv4/IPv6 traffic"
	}

	chain accept_to_lan {
		oifname "br-lan" counter packets 18744 bytes 12755676 accept comment "!fw4: accept lan IPv4/IPv6 traffic"
	}

	chain input_wan {
		jump input_wan_rule comment "!fw4: Custom input_wan rule chain"
		meta nfproto ipv4 udp dport 68 counter packets 2 bytes 656 accept comment "!fw4: Allow-DHCP-Renew"
		icmp type echo-request counter packets 0 bytes 0 accept comment "!fw4: Allow-Ping"
		meta nfproto ipv4 meta l4proto igmp counter packets 0 bytes 0 accept comment "!fw4: Allow-IGMP"
		meta nfproto ipv6 udp dport 546 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCPv6"
		ip6 saddr fe80::/10 icmpv6 type . icmpv6 code { mld-listener-query . 0, mld-listener-report . 0, mld-listener-done . 0, mld2-listener-report . 0 } counter packets 0 bytes 0 accept comment "!fw4: Allow-MLD"
		icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply, nd-router-solicit, nd-router-advert } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Input"
		icmpv6 type . icmpv6 code { packet-too-big . 0, parameter-problem . 0, nd-neighbor-solicit . 0, nd-neighbor-advert . 0, parameter-problem . 1 } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Input"
		ct status dnat accept comment "!fw4: Accept port redirections"
		jump reject_from_wan
	}

	chain output_wan {
		jump output_wan_rule comment "!fw4: Custom output_wan rule chain"
		jump accept_to_wan
	}

	chain forward_wan {
		jump forward_wan_rule comment "!fw4: Custom forward_wan rule chain"
		icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
		icmpv6 type . icmpv6 code { packet-too-big . 0, parameter-problem . 0, parameter-problem . 1 } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward"
		meta l4proto esp counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: Allow-IPSec-ESP"
		udp dport 500 counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: Allow-ISAKMP"
		ct status dnat accept comment "!fw4: Accept port forwards"
		jump reject_to_wan
	}

	chain accept_to_wan {
		meta nfproto ipv4 oifname "lan1" ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage"
		oifname "lan1" counter packets 9056 bytes 4786664 accept comment "!fw4: accept wan IPv4/IPv6 traffic"
	}

	chain reject_from_wan {
		iifname "lan1" counter packets 386 bytes 186883 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
	}

	chain reject_to_wan {
		oifname "lan1" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
	}

	chain dstnat {
		type nat hook prerouting priority dstnat; policy accept;
		jump dstnat_rule comment "!fw4: Custom dstnat rule chain"
		iifname "br-lan" jump dstnat_lan comment "!fw4: Handle lan IPv4/IPv6 dstnat traffic"
		iifname "lan1" jump dstnat_wan comment "!fw4: Handle wan IPv4/IPv6 dstnat traffic"
	}

	chain srcnat {
		type nat hook postrouting priority srcnat; policy accept;
		jump srcnat_rule comment "!fw4: Custom srcnat rule chain"
		oifname "br-lan" jump srcnat_lan comment "!fw4: Handle lan IPv4/IPv6 srcnat traffic"
		oifname "lan1" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
	}

	chain dstnat_lan {
		ip daddr 192.168.80.10 jump nat_pf_loopback_A
		udp dport 53 redirect
		tcp dport 53 redirect
		jump dstnat_lan_rule comment "!fw4: Custom dstnat_lan rule chain"
	}

	chain srcnat_lan {
		jump srcnat_lan_rule comment "!fw4: Custom srcnat_lan rule chain"
	}

	chain dstnat_wan {
		meta nfproto ipv4 tcp dport 80 redirect to :80
		jump dstnat_wan_rule comment "!fw4: Custom dstnat_wan rule chain"
	}

	chain srcnat_wan {
		jump srcnat_wan_rule comment "!fw4: Custom srcnat_wan rule chain"
		meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic"
	}

	chain raw_prerouting {
		type filter hook prerouting priority raw; policy accept;
	}

	chain raw_output {
		type filter hook output priority raw; policy accept;
	}

	chain mangle_prerouting {
		type filter hook prerouting priority mangle; policy accept;
		iifname "lan1" jump mangle_quotaqos_prerouting
		jump mangle_prerouting_rule comment "!fw4: Custom mangle_prerouting rule chain"
	}

	chain mangle_postrouting {
		type filter hook postrouting priority mangle; policy accept;
		jump mangle_postrouting_rule comment "!fw4: Custom mangle_postrouting rule chain"
		oifname "lan1" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 egress MTU fixing"
	}

	chain mangle_input {
		type filter hook input priority mangle; policy accept;
		jump mangle_input_rule comment "!fw4: Custom mangle_input rule chain"
		iifname "lan1" jump mangle_qos_ingress
	}

	chain mangle_output {
		type route hook output priority mangle; policy accept;
		jump mangle_output_rule comment "!fw4: Custom mangle_output rule chain"
	}

	chain mangle_forward {
		type filter hook forward priority mangle; policy accept;
		jump mangle_forward_rule comment "!fw4: Custom mangle_forward rule chain"
		iifname "lan1" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 ingress MTU fixing"
		iifname "lan1" jump mangle_qos_ingress
	}

	chain input_rule {
	}

	chain output_rule {
	}

	chain forward_rule {
		iifname "br-lan" meta nfproto ipv4 jump lease_mismatch_check
	}

	chain prerouting_rule {
	}

	chain dstnat_rule {
	}

	chain srcnat_rule {
		oifname "br-lan" jump nat_pf_loopback_C
	}

	chain input_lan_rule {
	}

	chain output_lan_rule {
	}

	chain forward_lan_rule {
	}

	chain dstnat_lan_rule {
	}

	chain srcnat_lan_rule {
	}

	chain input_wan_rule {
		meta nfproto ipv4 tcp dport 80 accept
		meta nfproto ipv6 tcp dport 80 accept
	}

	chain output_wan_rule {
	}

	chain forward_wan_rule {
	}

	chain dstnat_wan_rule {
	}

	chain srcnat_wan_rule {
	}

	chain mangle_prerouting_rule {
	}

	chain mangle_postrouting_rule {
	}

	chain mangle_input_rule {
	}

	chain mangle_output_rule {
	}

	chain mangle_forward_rule {
	}

	chain lease_mismatch_check {
		ip saddr != @lease_mismatch_ips ether saddr != @lease_mismatch_macs return
		ip saddr . ether saddr vmap @lease_mismatch_pairs
		reject
	}

	chain egress_restrictions {
		jump egress_whitelist
	}

	chain ingress_restrictions {
		jump ingress_whitelist
	}

	chain egress_whitelist {
	}

	chain ingress_whitelist {
	}

	chain nat_pf_loopback_A {
	}

	chain pf_loopback_B {
	}

	chain nat_pf_loopback_C {
	}

	chain mangle_qos_ingress {
		meta mark & 0x00007f00 != 0x00000000 ct mark set ct mark & 0xffff80ff | meta mark & 0x00007f00
		meta mark & 0x00007f00 != 0x00000000 return
		meta mark set 0x00000500
		ip saddr 192.168.1.2 meta mark set 0x00000200
		ct mark set ct mark & 0xffff80ff | meta mark & 0x00007f00
	}

	chain mangle_quotaqos_prerouting {
		meta mark set 0x00000000
	}
}
table bridge gfw {
	chain forward {
		type filter hook forward priority 0; policy accept;
	}

	chain input {
		type filter hook input priority 0; policy accept;
	}
}
table inet bwmon {
	chain input {
		type filter hook input priority filter - 1; policy accept;
		iifname "lan1" jump qos_ingress_bw
	}

	chain forward {
		type filter hook forward priority filter - 1; policy accept;
		iifname "lan1" jump qos_ingress_bw
	}

	chain mangle_postrouting {
		type filter hook postrouting priority mangle + 1; policy accept;
		oifname "lan1" jump mangle_qos_egress_bw
	}

	chain mangle_forward {
		type filter hook forward priority mangle - 1; policy accept;
	}

	chain mangle_input {
		type filter hook input priority mangle - 1; policy accept;
	}

	chain mangle_output {
		type filter hook output priority mangle - 1; policy accept;
	}

	chain qos_ingress_bw {
		ct mark set ct mark & 0x00ffffff
		ip daddr 192.168.1.0/24 ct mark set ct mark | 0x0f000000
		ip daddr 192.168.80.10 ct mark set ct mark | 0x0f000000
		ip6 daddr fdd4:2750:bad5::/60 ct mark set ct mark | 0x0f000000
		ct mark & 0x0f000000 == 0x00000000 return
		ct mark set ct mark & 0x00ffffff
		ct mark & 0x00007f00 == 0x00000200 bandwidth id "qos1-down-dclass_1-minute-15" type combined current-bandwidth 0 reset-interval minute intervals-to-save 15
		ct mark & 0x00007f00 == 0x00000200 bandwidth id "qos2-down-dclass_1-900-24" type combined current-bandwidth 0 reset-interval 900 reset-time 900 intervals-to-save 24
		ct mark & 0x00007f00 == 0x00000200 bandwidth id "qos3-down-dclass_1-hour-24" type combined current-bandwidth 0 reset-interval hour intervals-to-save 24
		ct mark & 0x00007f00 == 0x00000200 bandwidth id "qos4-down-dclass_1-day-31" type combined current-bandwidth 0 reset-interval day intervals-to-save 31
		ct mark & 0x00007f00 == 0x00000200 bandwidth id "qos5-down-dclass_1-month-12" type combined current-bandwidth 0 reset-interval month intervals-to-save 12
		ct mark & 0x00007f00 == 0x00000300 bandwidth id "qos1-down-dclass_2-minute-15" type combined current-bandwidth 0 reset-interval minute intervals-to-save 15
		ct mark & 0x00007f00 == 0x00000300 bandwidth id "qos2-down-dclass_2-900-24" type combined current-bandwidth 0 reset-interval 900 reset-time 900 intervals-to-save 24
		ct mark & 0x00007f00 == 0x00000300 bandwidth id "qos3-down-dclass_2-hour-24" type combined current-bandwidth 0 reset-interval hour intervals-to-save 24
		ct mark & 0x00007f00 == 0x00000300 bandwidth id "qos4-down-dclass_2-day-31" type combined current-bandwidth 29819508 reset-interval day intervals-to-save 31
		ct mark & 0x00007f00 == 0x00000300 bandwidth id "qos5-down-dclass_2-month-12" type combined current-bandwidth 29819508 reset-interval month intervals-to-save 12
		ct mark & 0x00007f00 == 0x00000400 bandwidth id "qos1-down-dclass_3-minute-15" type combined current-bandwidth 0 reset-interval minute intervals-to-save 15
		ct mark & 0x00007f00 == 0x00000400 bandwidth id "qos2-down-dclass_3-900-24" type combined current-bandwidth 0 reset-interval 900 reset-time 900 intervals-to-save 24
		ct mark & 0x00007f00 == 0x00000400 bandwidth id "qos3-down-dclass_3-hour-24" type combined current-bandwidth 0 reset-interval hour intervals-to-save 24
		ct mark & 0x00007f00 == 0x00000400 bandwidth id "qos4-down-dclass_3-day-31" type combined current-bandwidth 0 reset-interval day intervals-to-save 31
		ct mark & 0x00007f00 == 0x00000400 bandwidth id "qos5-down-dclass_3-month-12" type combined current-bandwidth 0 reset-interval month intervals-to-save 12
		ct mark & 0x00007f00 == 0x00000500 bandwidth id "qos1-down-dclass_4-minute-15" type combined current-bandwidth 34697 reset-interval minute intervals-to-save 15
		ct mark & 0x00007f00 == 0x00000500 bandwidth id "qos2-down-dclass_4-900-24" type combined current-bandwidth 178612 reset-interval 900 reset-time 900 intervals-to-save 24
		ct mark & 0x00007f00 == 0x00000500 bandwidth id "qos3-down-dclass_4-hour-24" type combined current-bandwidth 178612 reset-interval hour intervals-to-save 24
		ct mark & 0x00007f00 == 0x00000500 bandwidth id "qos4-down-dclass_4-day-31" type combined current-bandwidth 419393060 reset-interval day intervals-to-save 31
		ct mark & 0x00007f00 == 0x00000500 bandwidth id "qos5-down-dclass_4-month-12" type combined current-bandwidth 419393060 reset-interval month intervals-to-save 12
	}

	chain mangle_qos_egress_bw {
		ct mark set ct mark & 0x00ffffff
		ip saddr 192.168.1.0/24 ct mark set ct mark | 0x0f000000
		ip saddr 192.168.80.10 ct mark set ct mark | 0x0f000000
		ip6 saddr fdd4:2750:bad5::/60 ct mark set ct mark | 0x0f000000
		ct mark & 0x0f000000 == 0x00000000 return
		ct mark set ct mark & 0x00ffffff
	}
}

Do you also have any quotas applying to the network or the device?

No, none at all.

[Lantis]

Assuming your PC is 192.168.1.2?
In the download direction your PC is the destination, not source. That should fix it

[francisuk1989]

Assuming your PC is 192.168.1.2?

Yes

In the download direction your PC is the destination, not source. That should fix it

That fixed it.