[BPI-R3] hardware offloading with flowtables


I am trying to get the hw offloading to work using flowtables from nftables. Here is relevant part of my configuration:

table ip filter {
  # enable flow offloading for better throughput
   flowtable f {
      hook ingress priority 0;
      devices = { wan, br-lan };
  chain input {
    type filter hook input priority 0; policy drop;
     # enable flow offloading for better throughput
     ip protocol { tcp, udp } flow offload @f
     iifname { "br-lan" } accept comment "Allow local network to access the router"

However this configuration fails to be applied with following error:

       > ruleset.conf:5:15-15: Error: Could not process rule: No such file or directory
       >     flowtable f {
       >               ^
       > ruleset.conf:13:28-42: Error: Could not process rule: No such file or directory
       >   ip protocol { tcp, udp } flow offload @f
       >                            ^^^^^^^^^^^^^^^

System info:

Linux surfer 6.4.0 #1-NixOS SMP Sun Jun 25 23:29:58 UTC 2023 aarch64 GNU/Linux
$ lsmod                                                                                                                                                                                                                                                
Module                  Size  Used by
nft_flow_offload       12288  0
nf_flow_table          36864  1 nft_flow_offload
nft_masq               12288  1
nft_ct                 16384  4
nft_chain_nat          12288  2
nf_nat                 49152  2 nft_masq,nft_chain_nat
nf_conntrack          118784  5 nf_nat,nft_flow_offload,nft_ct,nft_masq,nf_flow_table
nf_defrag_ipv6         24576  1 nf_conntrack
nf_defrag_ipv4         12288  1 nf_conntrack
nf_tables             229376  79 nft_flow_offload,nft_ct,nft_masq,nft_chain_nat
libcrc32c              12288  1 nf_tables
nfnetlink              20480  1 nf_tables
crct10dif_ce           12288  1
sch_fq_codel           16384  17
tun                    57344  0
tap                    28672  0
macvlan                28672  0
fuse                  139264  1
mt7915e               159744  0
mt76_connac_lib        65536  1 mt7915e
mt76                   86016  2 mt7915e,mt76_connac_lib
mac80211              561152  3 mt76,mt7915e,mt76_connac_lib
libarc4                12288  1 mac80211
cfg80211              405504  4 mt76,mt7915e,mac80211,mt76_connac_lib

Any idea what could be the reason? Did someone manage to get this working on either openwrt or another linux distro?

I guess you miss inet/ip flowtable options

Shows the module is already loaded.

I’m also quite curious on how to set offloading… Still have to try.

I found this:

Talking about the interfaces in the bridge, adding the interfaces instead of the bridge…


Read here: https://elixir.bootlin.com/linux/v6.4.1/source/Documentation/networking/nf_flowtable.rst#L161

Also checkout the offload flag https://elixir.bootlin.com/linux/v6.4.1/source/Documentation/networking/nf_flowtable.rst#L186

I mean these:


Only marked the first line to have all options listed

And yes hw offloading works only on hw interfaces,offloading on bridge will not work

I see now, that one was marked, you meant all of them. I will check if I have them enabled.

Turns out that these 2 do not exist anymore.

Seems it is replaced by NF_FLOW_TABLE_INET near 5.17

So question is: can config applied with NF_FLOW_TABLE_INET added? Afair it can be applied with “wrong” interfaces like bridges,but it simply does not do any hw offloading

Here it says that you need to add the bridge ports.



Although in the first post, it is added to a

table ip filter {}

But I believe it should be like in the documentation:

table inet x {}

It depends on how you want to define your firewall…inet is ipv4+ipv6 and so statements have to be compatible with both protocols…you can also define an ip(v4) and ipv6 firewall separately (like i have)

Hi, thank you both for the answers. I didn’t have time to test it yet as I discovered that there are more modules that has to be enabled in my kernel. I will test that and report with my findings.