@Nathan-TP 

# Bug Report: ER707-M2 IDS/IPS Causes Complete WAN Traffic Blackout (FW 1.4.x)

**Product:** TP-Link ER707-M2 v1.0
**Firmware:** 1.4.5 (Build 20260722) — reproduced on 1.4.2
**Controller:** Omada Software Controller 6.2.14.11 (off-device, self-hosted)
**Severity:** Critical — IDS/IPS feature completely non-functional; cannot be enabled in production

---

## Summary

Enabling IDS/IPS at any security level immediately blocks all WAN forwarded traffic.
The blackout is permanent (confirmed: 11 minutes with no recovery).
Disabling IDS restores traffic after ~22 seconds.
No logs, no alerts, and no Threat Management events appear during the blackout.

This is a regression from FW 1.3.x, where IDS/IPS worked correctly.

---

## Reproduction Steps

1. ER707-M2 connected to Omada Software Controller 6.2.14.11
2. In Omada: Transmission → IDS/IPS → Enable IDS or IPS at any security level
3. Immediately ping 8.8.8.8 from any LAN client
4. Expected: traffic continues, slight throughput decrease (as in FW 1.3.x)
5. Actual: all pings timeout immediately; all forwarded traffic stopped

---

## Technical Findings (summary)

I have collected diagnostic dumps from the device during the blackout and performed a detailed analysis. Full root cause analysis is in the attached design document.

**Root cause: two compounding bugs**

**Bug 1 — IPS-CORE kernel module hook is fail-closed before the IPS Worker is ready**

The `IPS-CORE` proprietary kernel module registers a netfilter hook at `NF_INET_FORWARD`
and immediately drops all forwarded packets. The hook should pass traffic through until the
IPS Worker (Suricata-based `ips` binary) establishes a mmap connection and signals readiness.
Instead, traffic is dropped from the moment IPS is enabled.

Evidence: filter table FORWARD chain shows 0 packets in dump collected 11 minutes into
blackout; mangle PREROUTING shows 17 million packets (packets arrive, are never forwarded).

**Bug 2 — IPS Worker never completes initialization (rule fetch failure)**

The IPS Worker starts (PID confirmed, state R, 45–48% CPU continuously, VSZ growing)
but never loads rules from the Omada controller. After 11 minutes:
- `ips_forward_blacklist` iptables chain: empty (zero signatures)
- Worker has zero network connections (confirmed via netstat — no connection to controller)
- Syslog: `tmngtd: The Conf ips: has no available entry`

Config: `option level 'controller'` with `option cache '0'` — rules must come from controller
every startup, no local cache. Worker cannot reach or parse the rules and spins indefinitely.

**Combined effect:** IPS-CORE hook drops all traffic from t=0; Worker never becomes ready;
blackout is permanent until IDS is manually disabled.

**FW 1.3.x vs 1.4.x:** FW 1.3.x used SFE (software fastpath) inline for IPS — no separate
kernel hook, traffic never interrupted during init. FW 1.4.x introduced IPS-CORE kernel hook
with fail-closed default — the architectural change broke the feature entirely.

---

## Secondary Issue

After disabling IPS, `clear all foe entry` is called 4× (confirmed in dmesg), flushing the
MediaTek HNAT flow offload table. Traffic does not resume for ~22 seconds (23rd ping
succeeds). Every IPS enable/disable cycle causes this disruption.

---

## Requested Fixes

1. **CRITICAL:** Change IPS-CORE hook to fail-open (ACCEPT all) during Worker initialization.
   Only switch to fail-closed/inspect mode after Worker signals ready via mmap.
2. **CRITICAL:** Fix rule delivery for `option level 'controller'` in FW 1.4.x — investigate
   why Worker has no network connections to the controller.
3. **IMPORTANT:** Add IPS Worker initialization logging to syslog and Omada Threat Management.
4. **IMPORTANT:** Add local rule cache as fallback when controller is unreachable on startup.
5. **INVESTIGATE:** Reduce HNAT flush delay from ~22 seconds after IPS state change.

---

## Attachments (by email only)

- `er707-m2-ids-bug-artifacts.tar.gz` — device dumps, kernel log, syslog, UCI configs
- `2026-08-07-er707-ids-diagnosis-design.md` — full root cause analysis with packet flow
  diagrams, evidence table, and detailed R&D recommendations with verification protocol