Update miniarm-rk3288_defconfig

[Truv]

Add iptables components configurations to distinguish traffic smoothly via ipset. It will be suitable for situation like this

[jamess-huang]

Excuse me, may I know why need this change ? I mean that from the link you provide, the author TkBd said that the issue was fixed on version 2.0.6.
https://tinkerboarding.co.uk/forum/thread-1461-post-6586.html#pid6586

[Truv]

Hello,

Thank you for your reply.

I tried his way, but nothing could be changed until rebuilding kernel with the added modules mentioned as listed. Actually this issue is still exist even on version 2.0.7

I guess what he mean is the 'NAT' alone available on 2.0.6, actually, it's available at least on version 2.0.4. If you just use the basic NAT functions like to be set as a router, it will be totally Okay. But if you want make some further match such as using ipset or something else to match target much more precisely. The components listed above must be taken into account.

The error message: 'iptables: No chain/target/match by that name.' is not caused by NAT missing, but by the missing of modules which support the command '-m set --match-set aaa dst'. I used two versions of TinkerOS from 2.0.6 to 2.0.7. There is no doubt it's necessary.

Finally, let me illustrate the motivation. I want redirect the traffic to specific country to the specific port on my server. I imported the ip blocks of such a country to ipset and name it as 'aaa' so that iptables can match then by using '-m set --match-set aaa dst'. iptables will return error as 'No chain/target/match by that name.' if missing the modules above.

If those are still confuse you. I can set another usage as an example that is proxy gateway. Suppose you are in the US and we set tinkerboard as a gateway proxy, it can match the destination of every link, if the destination belongs to the US, then go directly. By contrast, if the destination towards overseas, put all traffic to listening port (often 1080) of the proxy server.

iptables -t nat -A PREROUTING -p tcp -m set  --match-set theUS dst -j RETUEN
iptables -t nat -A PREROUTING -p tcp -m set ! --match-set theUS dst -j REDIRECT --to-port 1080

Those two commands need those components.

Bests,

[jamess-huang]

Hi,
Thanks for your detail explanation, we will check these kernel configs and feedback to you. Thank you.