• AX6 firmware version: 1.1.10, currently the latest version

  • SSH has been unlocked through another Openwrt router, and only shellclash is running inside AX6, without modifying any other files

  • After setting custom rules on the port forwarding page and clicking save and taking effect, attempting to access via public IP + port fails

  • Log in to AX6 via ssh and manually execute /etc/init.d/firewall -reload

root@XiaoQiang:~# /etc/init.d/firewall reload
Warning: Section @zone[1] (wan) cannot resolve device of network 'wan6'
Warning: Section 'ready_zone' cannot resolve device of network 'ready'
Warning: Section 'guest_8999' refers to not existing zone 'guest'
Warning: Section 'guest_8300' refers to not existing zone 'guest'
Warning: Section 'guest_7080' refers to not existing zone 'guest'
Warning: Option 'wan15001rdr1'.ftype is unknown
Warning: Option 'wan15000rdr1'.ftype is unknown
Warning: Section @zone[2] (ready) has no device, network, subnet or extra options
 * Clearing IPv4 filter table
 * Clearing IPv4 nat table
 * Clearing IPv4 mangle table
 * Populating IPv4 filter table
   * Rule 'Allow-DHCP-Renew'
   * Rule 'Allow-Ping'
   * Rule 'DHCP for ready'
   * Rule 'DHCP for ready'
   * Rule 'minet ready'
   * Rule 'minet ready'
   * Redirect 'nas5001'
   * Redirect 'nas5000'
   * Forward 'lan' -> 'wan'
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'ready'
 * Populating IPv4 nat table
   * Redirect 'nas5001'
   * Redirect 'nas5000'
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'ready'
 * Populating IPv4 mangle table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'ready'
 * Set tcp_ecn to off
 * Set tcp_syncookies to on
 * Set tcp_window_scaling to on
 * Running script '/lib/firewall.sysapi.loader webinitrdr'
 * Running script '/lib/firewall.sysapi.loader dnsmiwifi'
 * Running script '/lib/firewall.sysapi.loader macfilter'
 * Running script '/lib/firewall.sysapi.loader ipv6_masq'
 * Running script '/lib/firewall.sysapi.loader set_tcpmss'
 * Running script '/lib/firewall.sysapi.loader miot'
 * Running script '/lib/firewall.sysapi.loader parentalctl'
 * Running script '/usr/share/miniupnpd/firewall.include'
 * Running script '/etc/firewall.d/qca-nss-ecm'
   ! Failed with exit code 1

Found an error when running to qca-nss-ecm, after checking, it is found that this nss is related to wireless acceleration, the following is the nss configuration inside the firewall:

ecm_type=`uci -q get ecm.global.acceleration_engine`
if [ $ecm_type = "nss" -o $ecm_type = "auto" ]; then
        chk=$(iptables -L FORWARD 2>/dev/null | grep -c 'PHYSDEV')
        if [ $chk -lt 1 ]; then
                iptables -I FORWARD -m physdev --physdev-is-bridged -j ACCEPT
        fi
        ipv6_fw_disable=$(uci -q get firewall.@defaults[0].disable_ipv6)
        chk6=$(ip6tables -L FORWARD 2>/dev/null | grep -c 'PHYSDEV')
        if [ $chk6 -lt 1 -a "$ipv6_fw_disable" = "0" ]; then
                ip6tables -I FORWARD -m physdev --physdev-is-bridged -j ACCEPT
        elif [ "$ipv6_fw_disable" = "1" ]; then
                ip6tables -D FORWARD -m physdev --physdev-is-bridged -j ACCEPT 2>/dev/null
        fi
else
        iptables -D FORWARD -m physdev --physdev-is-bridged -j ACCEPT 2>/dev/null
        ip6tables -D FORWARD -m physdev --physdev-is-bridged -j ACCEPT 2>/dev/null
fi

For the time being, I don't want to study it further, so I will directly find the nss-related rules in /etc/config/firewall and comment them out, then restart the firewall:

root@XiaoQiang:~# vi /etc/config/firewall
root@XiaoQiang:~# /etc/init.d/firewall reload
Warning: Section @zone[1] (wan) cannot resolve device of network 'wan6'
Warning: Section 'ready_zone' cannot resolve device of network 'ready'
Warning: Section 'guest_8999' refers to not existing zone 'guest'
Warning: Section 'guest_8300' refers to not existing zone 'guest'
Warning: Section 'guest_7080' refers to not existing zone 'guest'
Warning: Option 'wan15001rdr1'.ftype is unknown
Warning: Option 'wan15000rdr1'.ftype is unknown
Warning: Section @zone[2] (ready) has no device, network, subnet or extra options
 * Clearing IPv4 filter table
 * Clearing IPv4 nat table
 * Clearing IPv4 mangle table
 * Populating IPv4 filter table
   * Rule 'Allow-DHCP-Renew'
   * Rule 'Allow-Ping'
   * Rule 'DHCP for ready'
   * Rule 'DHCP for ready'
   * Rule 'minet ready'
   * Rule 'minet ready'
   * Redirect 'nas5001'
   * Redirect 'nas5000'
   * Forward 'lan' -> 'wan'
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'ready'
 * Populating IPv4 nat table
   * Redirect 'nas5001'
   * Redirect 'nas5000'
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'ready'
 * Populating IPv4 mangle table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'ready'
 * Set tcp_ecn to off
 * Set tcp_syncookies to on
 * Set tcp_window_scaling to on
 * Running script '/lib/firewall.sysapi.loader webinitrdr'
 * Running script '/lib/firewall.sysapi.loader dnsmiwifi'
 * Running script '/lib/firewall.sysapi.loader macfilter'
 * Running script '/lib/firewall.sysapi.loader ipv6_masq'
 * Running script '/lib/firewall.sysapi.loader set_tcpmss'
 * Running script '/lib/firewall.sysapi.loader miot'
 * Running script '/lib/firewall.sysapi.loader parentalctl'
 * Running script '/usr/share/miniupnpd/firewall.include'
root@XiaoQiang:~#
  • At this point, try accessing the forwarded port, and the public IP + port can normally access the NAS on the intranet: