---
# System prepended metadata

title: Cowrie Backend default filter and OpenWRT

---

# Cowrie Backend default filter and OpenWRT

## Instruction
Recently, I encountered an issue that when using a stable release openwrt [image](https://downloads.openwrt.org/releases/22.03.3/targets/x86/64/openwrt-22.03.3-x86-64-generic-ext4-combined-efi.img.gz) as a cowrie backend with cowrie's default network filter([default_filter.xml](https://github.com/cowrie/cowrie/blob/master/share/cowrie/pool_configs/default_filter.xml)), the backend vm can't recieve dhcp replies so cowrie can't establish ssh connections to the backend.

## Analysis
After days of debugging, I noticed during OpenWRT's boot procedure, it will send a udp packet about **FAILSAFE MODE** from `192.168.1.1` to `192.168.1.255`.
![](https://i.imgur.com/wpiqSSn.png)

It seems that this packet will mislead the filter about the vm's ip address, which makes SSH traffics unreachable.

## Workaround
My workaround is to build my own image from [OpenWRT source](https://openwrt.org/docs/guide-developer/toolchain/use-buildsystem).
The bellow parameters in `Image configuration` will disable the failsafe mode and that packet.
```
CONFIG_TARGET_PREINIT_DISABLE_FAILSAFE=y
CONFIG_TARGET_PREINIT_SUPPRESS_FAILSAFE_NETMSG=y
```
The result image will work correctly under the default network filter.

However, I don't know why the OpenWRT image provided by cowrie doesn't send that packet when it is started by cowrie. The packet can be found if I start the vm with `virsh define {filename}.xml` command. The `xml` file is copied from vm generated by cowrie.
