fix(netifyd): improvements

packages/netifyd/README.md

@@ -63,3 +63,27 @@ uci del_list netifyd.config.bypassv4='192.168.1.0/24 | My network'
 uci commit netifyd
 reload_config
 ```
+
+## Firewall-local traffic analysis
+
+The `firewall_traffic` option controls how traffic to/from the firewall itself is handled. It accepts three values:
+
+| Value | Description |
+|---|---|
+| `full` | Analyze all firewall traffic: inbound, outbound (firewall-initiated), and forwarded |
+| `inbound` | Analyze only traffic initiated from outside toward the firewall, plus forwarded traffic (default) |
+| `forward` | Analyze only forwarded traffic; ignore all firewall-local traffic entirely |
+
+```bash
+# Default: only inbound connections to the firewall + forwarded traffic
+uci set netifyd.config.firewall_traffic='inbound'
+
+# Full analysis including firewall-originated connections (e.g. DNS, monitoring)
+uci set netifyd.config.firewall_traffic='full'
+
+# Forwarded traffic only, skip all local firewall traffic
+uci set netifyd.config.firewall_traffic='forward'
+
+uci commit netifyd
+reload_config
+```

packages/netifyd/files/etc/netifyd/profiles.d/00-default.conf

@@ -157,7 +157,7 @@ all = include
 
 [netlink]
 # Set the Netlink buffer size
-buffer_size = 32768
+buffer_size = 327680
 bridge_pvid_discovery = no
 
 # vim: set ft=dosini :

packages/netifyd/files/usr/sbin/ns-netifyd-configure.py

@@ -34,10 +34,18 @@
     }
 
     # push input packets to userspace queues for DPI analysis
+{%- if 'input' in firewall_chains %}
     chain nfq_input {
         type filter hook input priority filter + 10; policy accept;
         iifname lo accept
 
+        # Skip untracked traffic
+        ct state untracked accept
+{%- if 'output' not in firewall_chains %}
+        # Skip reply traffic for connections initiated by the firewall itself
+        # (e.g. DNS responses, monitoring ping replies)
+        ct direction reply accept
+{%- endif %}
         # Accept traffic matching bypass set
         ip saddr @nfq_bypass_v4 accept
         ip daddr @nfq_bypass_v4 accept
@@ -50,11 +58,15 @@
         # Traffic to queues 54-57
         queue flags bypass to 54-57
     }
+{%- endif %}
 
     # push forward packets to userspace queues for DPI analysis
+{%- if 'forward' in firewall_chains %}
     chain nfq_forward {
         type filter hook forward priority filter + 10; policy accept;
 
+        # Skip untracked traffic
+        ct state untracked accept
         # Accept traffic matching bypass set
         ip saddr @nfq_bypass_v4 accept
         ip daddr @nfq_bypass_v4 accept
@@ -67,12 +79,16 @@
         # Traffic to queues 50-53
         queue flags bypass to 50-53
     }
+{%- endif %}
 
+{%- if 'output' in firewall_chains %}
     # push output packets to userspace queues for DPI analysis
     chain nfq_output {
         type filter hook output priority filter + 10; policy accept;
         oifname lo accept
 
+        # Skip untracked traffic
+        ct state untracked accept
         # Accept traffic matching bypass set
         ip saddr @nfq_bypass_v4 accept
         ip daddr @nfq_bypass_v4 accept
@@ -85,6 +101,8 @@
         # Traffic to queues 54-57
         queue flags bypass to 54-57
     }
+{%- endif %}
+
 }
 """
 
@@ -125,11 +143,27 @@ def generate_nfq_table():
     # Format elements with optional comments for nftables
     v4_elements = _format_nft_elements(v4_raw)
     v6_elements = _format_nft_elements(v6_raw)
-
+
+    # Read which nftables chains to add for DPI analysis.
+    # Valid values: 'input', 'output', 'forward'.
+    # Defaults to all three chains if the option is missing.
+    valid_chains = {'input', 'output', 'forward'}
+    raw_chains = e_uci.get('netifyd', 'config', 'firewall_traffic', dtype=str, list=True, default=list(valid_chains))
+    firewall_chains = []
+    for chain in raw_chains:
+        if chain in valid_chains:
+            firewall_chains.append(chain)
+        else:
+            print(f"Warning: invalid firewall_traffic value '{chain}', ignoring. Valid values: {sorted(valid_chains)}")
+    if not firewall_chains:
+        print("Warning: no valid firewall_traffic chains configured, defaulting to all chains.")
+        firewall_chains = list(valid_chains)
+
     template = Environment(loader=BaseLoader()).from_string(NFQ_TABLE)
     render = template.render(
         v4_elements=v4_elements,
         v6_elements=v6_elements,
+        firewall_chains=firewall_chains,
     )
 
     # Apply nftables