From 48e4cd62af781fcecdb76fd3f6f7f5942d492cbc Mon Sep 17 00:00:00 2001 From: Imre Kleman Date: Sun, 8 Nov 2026 22:46:01 +0100 Subject: [PATCH] silabs-multiprotocol: Document otbr_firewall requirement on HAOS 18+ With otbr_firewall disabled, the otbr-agent start script runs `ip6tables-legacy -P FORWARD ACCEPT`. Home Assistant OS 18 ships a kernel without the legacy IPv6 filter table, so the command fails, the script aborts before starting otbr-agent and the app loops on "otbr-agent exited with code 3". Thread stops working while Zigbee keeps running. The firewall-enabled path uses only nftables-backed ip6tables and works. The app image is frozen, so document the requirement in DOCS.md and the CHANGELOG instead of changing the script. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01PtV5t6nUjRWVJ3bwaLMf9r --- silabs-multiprotocol/CHANGELOG.md | 7 +++++++ silabs-multiprotocol/DOCS.md | 10 ++++++++++ 2 files changed, 17 insertions(+) diff --git a/silabs-multiprotocol/CHANGELOG.md b/silabs-multiprotocol/CHANGELOG.md index c688df7e9..288ef8311 100644 --- a/silabs-multiprotocol/CHANGELOG.md +++ b/silabs-multiprotocol/CHANGELOG.md @@ -17,6 +17,13 @@ - Declare the `/dev/net/tun` device used by OpenThread Border Router. - The app image is unchanged from 2.4.5. +> [!WARNING] +> Known issue on Home Assistant OS 18 and later: `otbr_firewall: false` makes +> the OpenThread Border Router start script call `ip6tables-legacy`, which +> fails because the kernel no longer provides the legacy IPv6 filter table. +> `otbr-agent` then exits with code 3 in a loop and Thread stops working. +> Keep `otbr_firewall` set to `true` (the default). + ## 2.4.5 - Support Home Assistant Connect ZBT-1. diff --git a/silabs-multiprotocol/DOCS.md b/silabs-multiprotocol/DOCS.md index 1923a4259..cfbede575 100644 --- a/silabs-multiprotocol/DOCS.md +++ b/silabs-multiprotocol/DOCS.md @@ -84,6 +84,16 @@ App configuration: | otbr_log_level | Set the log level of the OpenThread BorderRouter Agent | | otbr_firewall | Enable OpenThread Border Router firewall to block unnecessary traffic | +> [!WARNING] +> On Home Assistant OS 18 and later, keep `otbr_firewall` set to `true` (the +> default). With the firewall disabled, the OpenThread Border Router start +> script runs `ip6tables-legacy`, which fails on these systems because the +> kernel no longer provides the legacy IPv6 filter table. The app log then +> repeats `ip6tables v1.8.7 (legacy): can't initialize ip6tables table +> 'filter': Table does not exist` and `otbr-agent exited with code 3`, Thread +> stops working while Zigbee keeps running. Re-enable the firewall and restart +> the app to recover. + ## Architecture The app runs several service internally. This architecture diagram shows what