OTBR docker on Synology NAS

[jghaanstra]

I'm trying to run the OTBR docker container on a Synology NAS but run into the error below. I found some old posts of people running OTBR on Synology, so at least in the past this was working. Could very well be that updates to the container broke support for the Synology as the kernel might not have some of the required stuff. I did find this thread here with a similar issue indicating that it's indeed related to missing stuff in ip6table. Building manually without firewall is not a road I want to go down though.

So I'm asking here, hoping someone could shed some light on this and confirm it doesnt work on Synology (or even better, tells me it's something I can actually fix).

+ main
+ [[ '' == \s\h\u\t\d\o\w\n ]]
�
p
+ . /dev/null
+ sudo sysctl --system
* Applying /etc/sysctl.d/10-console-messages.conf ...
kernel.printk = 4 4 1 7
* Applying /etc/sysctl.d/10-ipv6-privacy.conf ...
net.ipv6.conf.all.use_tempaddr = 2
net.ipv6.conf.default.use_tempaddr = 2
* Applying /etc/sysctl.d/10-kernel-hardening.conf ...
kernel.kptr_restrict = 1
* Applying /etc/sysctl.d/10-link-restrictions.conf ...
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
* Applying /etc/sysctl.d/10-magic-sysrq.conf ...
kernel.sysrq = 176
* Applying /etc/sysctl.d/10-network-security.conf ...
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.rp_filter = 1
* Applying /etc/sysctl.d/10-ptrace.conf ...
* Applying /etc/sysctl.d/10-zeropage.conf ...
vm.mmap_min_addr = 65536
* Applying /etc/sysctl.d/60-otbr-accept-ra.conf ...
net.ipv6.conf.eth0.accept_ra = 2
* Applying /etc/sysctl.d/60-otbr-ip-forward.conf ...
net.ipv6.conf.all.forwarding = 1
net.ipv4.ip_forward = 1
* Applying /etc/sysctl.conf ...
+ nat64_start
�
+ with NAT64
+ local value
++ printenv NAT64
�
1
�
+ [[ -z 1 ]]
+ [[ 1 == 1 ]]
+ '[' openthread = tayga ']'
+ nat44_start
+ with DOCKER
+ local value
++ printenv DOCKER
�
1
�
+ [[ -z 1 ]]
+ [[ 1 == 1 ]]
+ service otbr-nat44 start
+ dns64_start
�
+ with NAT64
+ local value
++ printenv NAT64
�
1
�
+ [[ -z 1 ]]
+ [[ 1 == 1 ]]
�
+ with DNS64
+ local value
++ printenv DNS64
�
0
�
+ [[ -z 0 ]]
+ [[ 0 == 1 ]]
+ return 0
+ firewall_start
+ with FIREWALL
+ local value
++ printenv FIREWALL
�
1
�
+ [[ -z 1 ]]
+ [[ 1 == 1 ]]
+ with DOCKER
+ local value
++ printenv DOCKER
�
1
�
+ [[ -z 1 ]]
+ [[ 1 == 1 ]]
+ service otbr-firewall start
+ case "$1" in
+ firewall_start
+ firewall_stop
+ ip6tables -C FORWARD -o wpan0 -j OTBR_FORWARD_INGRESS
ip6tables v1.6.1: Couldn't load target `OTBR_FORWARD_INGRESS':No such file or directory
Try `ip6tables -h' or 'ip6tables --help' for more information.
+ ip6tables -L OTBR_FORWARD_INGRESS
ip6tables: No chain/target/match by that name.
+ ipset_destroy_if_exist otbr-ingress-deny-src
+ ipset list otbr-ingress-deny-src
ipset v6.34: The set with the given name does not exist
+ ipset_destroy_if_exist otbr-ingress-deny-src-swap
+ ipset list otbr-ingress-deny-src-swap
ipset v6.34: The set with the given name does not exist
+ ipset_destroy_if_exist otbr-ingress-allow-dst
+ ipset list otbr-ingress-allow-dst
ipset v6.34: The set with the given name does not exist
+ ipset_destroy_if_exist otbr-ingress-allow-dst-swap
+ ipset list otbr-ingress-allow-dst-swap
ipset v6.34: The set with the given name does not exist
+ ipset create -exist otbr-ingress-deny-src hash:net family inet6
ipset v6.34: Kernel error received: set type not supported
+ die 'Failed to start firewall service'
+ echo ' *** ERROR:  Failed to start firewall service'
 *** ERROR:  Failed to start firewall service
+ exit 1

[jwhui]

The most likely reason is the kernel does not have CONFIG_IP_SET enabled in its kernel config.

[jghaanstra]

Thanx for the quick response. I validated this and it's indeed missing. Guess it's not going to work on a Synology NAS.