Jump to content

Firewall: Difference between revisions

From postmarketOS Wiki
Created page with "{{note|Firewall is currently being implemented in {{MR|2042|pmbootstrap}} and {{MR|2060|pmaports}}. This wiki page explains how it will be once both MRs are merged.}} New pos..."
 
mNo edit summary
Line 4: Line 4:


== Default rules ==
== Default rules ==
(explain default rules here)
(explain default rules here)


== Usage ==
== Usage ==
(explain how to enable / disable it)
(explain how to enable / disable it)


== Configuring the kernel to support nftables ==
== Configuring the kernel to support nftables ==
* Run <code>pmbootstrap kconfig check --nftables kernel-name </code> to get a list of kernel config options that need to be changed
* Run <code>pmbootstrap kconfig check --nftables kernel-name </code> to get a list of kernel config options that need to be changed
* Fix them up with <code>pmbootstrap kconfig edit</code>
* Fix them up with <code>pmbootstrap kconfig edit</code>

Revision as of 12:00, 29 May 2021

Note Firewall is currently being implemented in pmbootstrap!2042 and pmaports!2060. This wiki page explains how it will be once both MRs are merged.

New postmarketOS installations have nftables configured if the device's kernel has support for it.

Default rules

(explain default rules here)

Usage

(explain how to enable / disable it)

Configuring the kernel to support nftables

  • Run pmbootstrap kconfig check --nftables kernel-name to get a list of kernel config options that need to be changed
  • Fix them up with pmbootstrap kconfig edit
  • Add pmb:kconfigcheck-nftables to options= in your kernel's APKBUILD
  • Create a test install with pmbootstrap install
  • Boot it and verify that the firewall works
  • Create a merge request to pmaports.git with your changes

Once your changes are merged, pmbootstrap will enable the firewall by default for your device.