Firewall
Appearance
postmarketOS edge and v21.06 or higher have nftables configured if the device's kernel has support for it.
Default rules
The following rules are enabled by default:
- Allow incoming SSH on USB networking and WiFi interfaces
- Allow incoming DHCP requests on USB networking interface
- Without this, USB networking requires assigning a static IP address manually on the host, so this is included for convenience.
- Deny all incoming connections on wwan (cell data network)
- The assumption is no incoming connection on this network, which is owned/managed by cell carriers, should be trusted. Users aren't able to connect to their devices on this interface over the cell network.
- Allow all outgoing connections on all interfaces
Check if it is running
Firewall service status can be viewed by querying openrc:
$ sudo rc-service nftables status
* status: started
If the status is not started
, the kernel may not have support for nftables (see #Configuring the kernel to support nftables).
The currently loaded set of rules can be viewed with:
$ sudo nft list ruleset
table inet filter {
chain input {
type filter hook input priority filter; policy drop;
.....
Usage
The nftables
openrc init script controls loading the firewall on boot. This service can be disabled to disable the firewall, or enabled to re-enable it:
$ sudo rc-update add nftables # enable firewall on boot
$ sudo rc-update del nftables # disable firewall on boot
Additional rules can be added in /etc/nftables.d
. The following packages are available in pmaports to add additional rules/functionality:
- *
postmarketos-config-nftables-openusb
- Adds rule to allow all incoming connections over the USB networking interface, useful for debugging pmOS, but not recommended for normal use.
- *
postmarketos-config-nftables-log
- Adds rules to enable logging of incoming and dropped connections to the firewall, useful for debugging firewall-related connection issues. This may generate a lot of messages in syslog.
Configuring the kernel to support nftables
- Run
pmbootstrap kconfig check --nftables kernel-package-name
to get a list of kernel config options that need to be changed - Fix them up with
pmbootstrap kconfig edit
- Add
pmb:kconfigcheck-nftables
tooptions=
in your kernel's APKBUILD - Create a test install with
pmbootstrap install
- Boot it and verify that the firewall works
- Create a merge request to pmaports.git with your changes
See also
- pmbootstrap!2042: add support for firewall
- pmaports!2060: postmarketos-firewall: add package for installing/configuring default fw
- build.postmarketos.org#100: build all main and community devices with firewall enabled