Sample Header Ad - 728x90

Forwarding KDEConnect UDP packets between bridged APs with firewalld/firewall-cmd

0 votes
0 answers
75 views
I was having an issue where KDEConnect peers on my LAN could not see each other intermittently. Because the peers are on APs that are physically connected to and bridged on my main router, I tried changing settings involving hairpin, multicast to unicast, etc, which no real improvement. Fortunately, this answer by [@A.B](https://unix.stackexchange.com/users/251756/a-b ) seems to have solved the issue with bridge family forwarding/routing. https://unix.stackexchange.com/questions/745847/nftables-doesnt-see-kde-connect-packets-between-two-machines-on-the-same-interf Steps 1 and 2 were pretty straightforward for me to implement permanently. However, I would like to convert Step 3 of the answer, which uses nftables, into a permanent solution using firewalld/firewall-cmd instead. The rest of my firewall setup is already defined in firewalld, and I would prefer to keep it all straight in there, and not layer raw nft stuff also. I mostly understand what the nft commands are doing, but not well enough to find their exact corollary in firewall-cmd. I would have asked this in a comment on that other question, but, alas, I need more rep first. So, how can I implement these nft commands in firewalld instead?
table bridge filter {
    chain conntrack {
        ct state vmap { invalid : drop, established : accept, related : accept }
    }

    chain kdeconnect {
        udp dport 1714-1764 counter accept
        tcp dport 1714-1764 counter accept
    }

    chain forward {
        type filter hook forward priority filter; policy drop;
        jump conntrack
        ether type ip6 drop     # just like OP did: drop any IPv6
        icmp type echo-request counter accept
        jump kdeconnect
        ether type arp accept   # mandatory for IPv4 connectivity
        counter
    }
}
Thanks!
Asked by D.H (1 rep)
Sep 6, 2024, 05:47 PM