[12/8更新]OpenWrt 上实现 NAT1 (Full cone NAT) 的方法，无需 DMZ/UPnP

tin***

又有问题。。这回是打好了补丁却卡在编译fullconenet上了。。同样看不懂。。：
make[2]: Entering directory `/home/tinnlux/chaos_calmer/package/fullconenat'
make -j1 -C "/home/tinnlux/chaos_calmer/build_dir/target-mipsel_1004kc+dsp_uClibc-0.9.33.2/linux-ramips_mt7621/linux-3.18.45" CROSS_COMPILE="mipsel-openwrt-linux-uclibc-" ARCH="mips" SUBDIRS="/home/tinnlux/chaos_calmer/build_dir/target-mipsel_1004kc+dsp_uClibc-0.9.33.2/linux-ramips_mt7621/fullconenat-1.0" EXTRA_CFLAGS="" modules
make[3]: Entering directory `/home/tinnlux/chaos_calmer/build_dir/target-mipsel_1004kc+dsp_uClibc-0.9.33.2/linux-ramips_mt7621/linux-3.18.45'
  CC [M]  /home/tinnlux/chaos_calmer/build_dir/target-mipsel_1004kc+dsp_uClibc-0.9.33.2/linux-ramips_mt7621/fullconenat-1.0/xt_FULLCONENAT.o
/home/tinnlux/chaos_calmer/build_dir/target-mipsel_1004kc+dsp_uClibc-0.9.33.2/linux-ramips_mt7621/fullconenat-1.0/xt_FULLCONENAT.c: In function 'xt_in':
/home/tinnlux/chaos_calmer/build_dir/target-mipsel_1004kc+dsp_uClibc-0.9.33.2/linux-ramips_mt7621/fullconenat-1.0/xt_FULLCONENAT.c:46:3: warning: return discards 'const' qualifier from pointer target type [enabled by default]
   return par->in;
   ^
/home/tinnlux/chaos_calmer/build_dir/target-mipsel_1004kc+dsp_uClibc-0.9.33.2/linux-ramips_mt7621/fullconenat-1.0/xt_FULLCONENAT.c: In function 'xt_out':
/home/tinnlux/chaos_calmer/build_dir/target-mipsel_1004kc+dsp_uClibc-0.9.33.2/linux-ramips_mt7621/fullconenat-1.0/xt_FULLCONENAT.c:50:3: warning: return discards 'const' qualifier from pointer target type [enabled by default]
   return par->out;
   ^
/home/tinnlux/chaos_calmer/build_dir/target-mipsel_1004kc+dsp_uClibc-0.9.33.2/linux-ramips_mt7621/fullconenat-1.0/xt_FULLCONENAT.c: In function 'check_mapping':
/home/tinnlux/chaos_calmer/build_dir/target-mipsel_1004kc+dsp_uClibc-0.9.33.2/linux-ramips_mt7621/fullconenat-1.0/xt_FULLCONENAT.c:238:5: warning: passing argument 2 of 'nf_conntrack_find_get' makes integer from pointer without a cast [enabled by default]
     tuple_hash = nf_conntrack_find_get(net, zone, &original_tuple_item->tuple);
     ^
In file included from /home/tinnlux/chaos_calmer/build_dir/target-mipsel_1004kc+dsp_uClibc-0.9.33.2/linux-ramips_mt7621/fullconenat-1.0/xt_FULLCONENAT.c:28:0:
include/net/netfilter/nf_conntrack_core.h:55:1: note: expected 'u16' but argument is of type 'const struct nf_conntrack_zone *'
nf_conntrack_find_get(struct net *net, u16 zone,
^
/home/tinnlux/chaos_calmer/build_dir/target-mipsel_1004kc+dsp_uClibc-0.9.33.2/linux-ramips_mt7621/fullconenat-1.0/xt_FULLCONENAT.c: In function 'fullconenat_tg':
/home/tinnlux/chaos_calmer/build_dir/target-mipsel_1004kc+dsp_uClibc-0.9.33.2/linux-ramips_mt7621/fullconenat-1.0/xt_FULLCONENAT.c:494:8: warning: assignment makes pointer from integer without a cast [enabled by default]
   zone = nf_ct_zone(ct);
        ^
/home/tinnlux/chaos_calmer/build_dir/target-mipsel_1004kc+dsp_uClibc-0.9.33.2/linux-ramips_mt7621/fullconenat-1.0/xt_FULLCONENAT.c: In function 'fullconenat_tg_check':
/home/tinnlux/chaos_calmer/build_dir/target-mipsel_1004kc+dsp_uClibc-0.9.33.2/linux-ramips_mt7621/fullconenat-1.0/xt_FULLCONENAT.c:639:5: error: invalid use of undefined type 'struct nf_ct_event_notifier'
     ct_event_notifier.fcn = ct_event_cb;
     ^
/home/tinnlux/chaos_calmer/build_dir/target-mipsel_1004kc+dsp_uClibc-0.9.33.2/linux-ramips_mt7621/fullconenat-1.0/xt_FULLCONENAT.c:642:5: warning: passing argument 2 of 'nf_conntrack_register_notifier' from incompatible pointer type [enabled by default]
     if (nf_conntrack_register_notifier(par->net, &ct_event_notifier) == 0) {
     ^
In file included from include/net/netfilter/nf_conntrack_core.h:18:0,
                 from /home/tinnlux/chaos_calmer/build_dir/target-mipsel_1004kc+dsp_uClibc-0.9.33.2/linux-ramips_mt7621/fullconenat-1.0/xt_FULLCONENAT.c:28:
include/net/netfilter/nf_conntrack_ecache.h:66:12: note: expected 'struct notifier_block *' but argument is of type 'struct nf_ct_event_notifier *'
extern int nf_conntrack_register_notifier(struct net *net, struct notifier_block *nb);
            ^
/home/tinnlux/chaos_calmer/build_dir/target-mipsel_1004kc+dsp_uClibc-0.9.33.2/linux-ramips_mt7621/fullconenat-1.0/xt_FULLCONENAT.c: In function 'fullconenat_tg_destroy':
/home/tinnlux/chaos_calmer/build_dir/target-mipsel_1004kc+dsp_uClibc-0.9.33.2/linux-ramips_mt7621/fullconenat-1.0/xt_FULLCONENAT.c:666:7: warning: passing argument 2 of 'nf_conntrack_unregister_notifier' from incompatible pointer type [enabled by default]
       nf_conntrack_unregister_notifier(par->net, &ct_event_notifier);
       ^
In file included from include/net/netfilter/nf_conntrack_core.h:18:0,
                 from /home/tinnlux/chaos_calmer/build_dir/target-mipsel_1004kc+dsp_uClibc-0.9.33.2/linux-ramips_mt7621/fullconenat-1.0/xt_FULLCONENAT.c:28:
include/net/netfilter/nf_conntrack_ecache.h:67:12: note: expected 'struct notifier_block *' but argument is of type 'struct nf_ct_event_notifier *'
extern int nf_conntrack_unregister_notifier(struct net *net, struct notifier_block *nb);
            ^
make[4]: *** [/home/tinnlux/chaos_calmer/build_dir/target-mipsel_1004kc+dsp_uClibc-0.9.33.2/linux-ramips_mt7621/fullconenat-1.0/xt_FULLCONENAT.o] Error 1
make[3]: *** [_module_/home/tinnlux/chaos_calmer/build_dir/target-mipsel_1004kc+dsp_uClibc-0.9.33.2/linux-ramips_mt7621/fullconenat-1.0] Error 2
make[3]: Leaving directory `/home/tinnlux/chaos_calmer/build_dir/target-mipsel_1004kc+dsp_uClibc-0.9.33.2/linux-ramips_mt7621/linux-3.18.45'
make[2]: *** [/home/tinnlux/chaos_calmer/build_dir/target-mipsel_1004kc+dsp_uClibc-0.9.33.2/linux-ramips_mt7621/fullconenat-1.0/.built] Error 2
make[2]: Leaving directory `/home/tinnlux/chaos_calmer/package/fullconenat'
make[1]: *** [package/fullconenat/compile] Error 2
make[1]: Leaving directory `/home/tinnlux/chaos_calmer'
make: *** [package/fullconenat/compile] 错误 2

LGA***

tinnlux 发表于 2018-9-3 14:17
又有问题。。这回是打好了补丁却卡在编译fullconenet上了。。同样看不懂。。：
make[2]: Entering directo ...

那个补丁里没有定义 CONFIG_NF_CONNTRACK_CHAIN_EVENTS ，因此 fullconenat 源码里的 #ifdef 判断没有生效
在 Makefile 第 50 行 $(call Build/Prepare/Default) 后面加一行

1. $(SED) 's/#ifdef CONFIG_NF_CONNTRACK_CHAIN_EVENTS/#if 1/g'  $(PKG_BUILD_DIR)/xt_FULLCONENAT.c

复制代码

tin***

LGA1150 发表于 2018-9-3 15:09
那个补丁里没有定义 CONFIG_NF_CONNTRACK_CHAIN_EVENTS ，因此 fullconenat 源码里的 #ifdef 判断没有生 ...

太感谢了。。我想求教系统的学习这些东西从哪里能学呢？

tin***

补丁都打了，fullcorenet也生成了，firewall也更新打了补丁。结果还是失败。。。不搞了郁闷，不行改玩软路由得了。不用费心想着驱动的问题

tin***

手上mt7620的老百兆路由在最新的openwrt上编译一遍成功，刷入也是fullcore。。主用的这个k2p可算是弄不好了。。

LGA***

tinnlux 发表于 2018-9-3 18:25
补丁都打了，fullcorenet也生成了，firewall也更新打了补丁。结果还是失败。。。不搞了郁闷，不行改玩软路 ...

dmesg 有错误信息吗

tin***

LGA1150 发表于 2018-9-3 18:55
dmesg 有错误信息吗

不会看。。我已经恢复备份了，因为这个路由是主用的，不能老这么折腾

li***

这个要支持

tin***

老哥我又来了，我放弃了k2p的wifi，现在编译了最新版的openwrt固件，通过你的源码成功实现了fullcone，但是k2p这个型号还是有点bug，手上其他mt7620的机型都很正常，只有k2p用同样的源码出来的固件有问题。问题是：防火墙无法重启，一选择重启则路由卡死，ping不通，只能重启，而且在防火墙自定义的规则会完全无效。请问这应该怎么修复呢？

rul***

移动宽带，也能实现吗？

lxh***

Full cone NAT启用，igmpproxy无法使用！

gll***

这个必须要记号一个，太感谢楼主了~~~

抛砖***

make menuconfig时报这些个错是怎么回事，虽然能编译成功，但测试没生效啊 ，（最新trunk）
root@debian:~/openwrt# make menuconfig
Collecting package info: done
Collecting target info: done
tmp/.config-package.in:306:error: recursive dependency detected!
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
tmp/.config-package.in:306:     symbol PACKAGE_firewall-FULLCONENAT depends on PACKAGE_firewall
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
tmp/.config-package.in:280:     symbol PACKAGE_firewall is selected by PACKAGE_luci-app-firewall
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
tmp/.config-package.in:42782:   symbol PACKAGE_luci-app-firewall is selected by PACKAGE_luci
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
tmp/.config-package.in:42063:   symbol PACKAGE_luci is selected by PACKAGE_luci-ssl
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
tmp/.config-package.in:42123:   symbol PACKAGE_luci-ssl depends on PACKAGE_firewall-FULLCONENAT
tmp/.config-package.in:60420:error: recursive dependency detected!
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
tmp/.config-package.in:60420:   symbol PACKAGE_iptables is selected by PACKAGE_virtual**bypass
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
tmp/.config-package.in:94906:   symbol PACKAGE_virtual**bypass is selected by PACKAGE_luci-app-virtual**bypass
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
tmp/.config-package.in:43530:   symbol PACKAGE_luci-app-virtual**bypass depends on PACKAGE_iptables


Your configuration changes were NOT saved.

LGA***

抛砖引玉 发表于 2018-12-8 16:48
make menuconfig时报这些个错是怎么回事，虽然能编译成功，但测试没生效啊

root@debian:~/openwrt# ma ...

好像是依赖包设置的问题，我今晚修一下

hello***

看看，今天又更新了啥呢？