Skip to content

20-firewall: Execute has_zone and and fw4 in background to avoid slow execution of hotplug.d/iface scripts#83

Open
rdevshp wants to merge 1 commit into
openwrt:masterfrom
rdevshp:patch-1
Open

20-firewall: Execute has_zone and and fw4 in background to avoid slow execution of hotplug.d/iface scripts#83
rdevshp wants to merge 1 commit into
openwrt:masterfrom
rdevshp:patch-1

Conversation

@rdevshp
Copy link
Copy Markdown

@rdevshp rdevshp commented Nov 12, 2025

This pull request fixes openwrt/openwrt#20723

@rdevshp
20-firewall: Execute has_zone and and fw4 in background to avoid slow…
083a4a5 
… execution of hotplug scripts

Signed-off-by: rdevshp <rdevshp@gmail.com>
@brada4
Copy link
Copy Markdown

brada4 commented Nov 12, 2025

Something similar by @ptpt52 (pre-dating my impromptu re-invention) ? https://github.com/x-wrt/x-wrt/blob/master/package/network/config/firewall4/patches/200-fw4-hotplug-fork.patch

brada4
brada4 suggested changes Nov 12, 2025
View reviewed changes
Copy link
Copy Markdown

@brada4 brada4 left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You have to limit forking of new copies of reload attempts , rapid flipping of link externally would unnecesarily accumulate waiting background tasks.

@rdevshp
Copy link
Copy Markdown
Author

rdevshp commented Nov 12, 2025

What do you think would be the ideal approach here to avoid excessive reload attempts & unnecessarily accumulate background tasks?
I am planning to create a new service that actually executes fw4 -q reload, and the 20-firewall script would merely send a fw4 reload notification to the new service without actually doing the reload itself. Do you think this is a good idea?

@brada4
Copy link
Copy Markdown

brada4 commented Nov 13, 2025 •
edited
Loading

It is not about clicks in the interface that go in sync with 🤣 background 🤣 activity, it is about rapidly (I tried 10hz) flipping connected ethernet with zone like wan and building up said activities.
(but totally agree massive cpu time hogs should be out of hotplug)

brada4 added a commit to brada4/firewall4 that referenced this pull request May 17, 2026
@brada4
ruleset: always reload entire fw4 table
5fec0e1 
Always fully reload our table to permit future "policy drop" chains
being switched on and off by an option
Obsoletes logic tracking flowtable lifecycle and avoids
one nft command call somewhat backing openwrt#83

Signed-off-by: Andris PE <neandris@gmail.com>
@brada4 brada4 mentioned this pull request May 17, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@brada4 brada4 brada4 requested changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Very slow ifup /etc/hotplug.d/iface script performance

2 participants

@rdevshp @brada4