feat: support to auto config firewall (firewalld)

[mzz2017]

Background

global {
  auto_config_firewall_rule: true
}

It performs:

nft list table inet firewalld && nft 'insert rule inet firewalld filter_INPUT mark & 0x08000000 == 0x08000000 accept'

Checklist

• The Pull Request has been fully tested
• There's an entry in the CHANGELOGS
• There is a user-facing docs PR against https://github.com/daeuniverse/dae

Full Changelogs

• [Implement ...]

Issue Reference

Closes #419

Test Result

[Basstorm]

root@R66S:~# nft list table inet firewalld && nft 'insert rule inet firewalld filter_INPUT mark & 0x08000000 == 0x08000000 accept'
Error: No such file or directory
list table inet firewalld
                ^^^^^^^^^

For immortalwrt 23.05 or maybe mainstream openwrt the commnd shoule be

nft 'insert rule inet fw4 input mark 0x8000000 accept'

Is there a more compatible implementation?
nevermind. I didnt see the todo line..

[mzz2017]

@Basstorm Thanks for test. It doesn't matter. I'll try it with fw4 again.

[mzz2017]

@Basstorm I've added fw4 support. Could you please try it?

[Basstorm]

@mzz2017 没毛病

[nobody116]

环境：openSUSE + 本机代理（WAN）
重启之后无法访问代理网站，执行 sudo systemctl restart/reload dae.service 代理恢复正常工作，即 curl 1.1.1.1 -v 仅在 reload/restart 之后正常。

> sudo /usr/local/bin/dae -v
dae version unstable-20240110.pr-420.r8.9f4776
go runtime go1.21.5 linux/amd64
Copyright (c) 2022-2024 dae
License GNU AGPLv3 <https://github.com/daeuniverse/dae/blob/main/LICENSE>

[mzz2017]

环境：openSUSE + 本机代理（WAN）

重启之后无法访问代理网站，执行 sudo systemctl restart/reload dae.service 代理恢复正常工作，即 curl 1.1.1.1 -v 仅在 reload/restart 之后正常。

> sudo /usr/local/bin/dae -v

dae version unstable-20240110.pr-420.r8.9f4776

go runtime go1.21.5 linux/amd64

Copyright (c) 2022-2024 dae

License GNU AGPLv3 <https://github.com/daeuniverse/dae/blob/main/LICENSE>

此问题可能和 #418 有关，开 log level: trace，检查日志是否第一次 connectivity check 失败，第二次成功

[nobody116]

环境：openSUSE + 本机代理（WAN）
重启之后无法访问代理网站，执行 sudo systemctl restart/reload dae.service 代理恢复正常工作，即 curl 1.1.1.1 -v 仅在 reload/restart 之后正常。

> sudo /usr/local/bin/dae -v

dae version unstable-20240110.pr-420.r8.9f4776

go runtime go1.21.5 linux/amd64

Copyright (c) 2022-2024 dae

License GNU AGPLv3 <https://github.com/daeuniverse/dae/blob/main/LICENSE>

此问题可能和 #418 有关，开 log level: trace，检查日志是否第一次 connectivity check 失败，第二次成功

是的，第一次 Connectivity Check 失败，第二次 Connectivity Check 成功

level=debug msg="Connectivity Check Failed" err="rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp <nil>->ip:port: connect: network is unreachable"" network="udp4(DNS)" node=SJC

该日志在 policy 为 fixed(0) 时默认没有吗，修改 policy 为 min_moving_avg 找到了。

[mzz2017]

@nobody116 看看是不是第二次成功之后就可以正常联网了

[nobody116]

@nobody116 看看是不是第二次成功之后就可以正常联网了

第二次成功之后可以正常代理

[dae-prow]

🧪 Since the PR has been fully tested, please consider merging it.

[sumire88]

Good job. Thanks!