Firewall

From postmarketOS

postmarketOS edge and v21.06 or higher have nftables configured if the device's kernel has support for it.

Default rules

The following rules are enabled by default:

Allow incoming SSH on USB networking and WiFi interfaces
Allow incoming DHCP requests on USB networking interface
Without this, USB networking requires assigning a static IP address manually on the host, so this is included for convenience.
Deny all incoming connections on wwan (cell data network)
The assumption is no incoming connection on this network, which is owned/managed by cell carriers, should be trusted. Users aren't able to connect to their devices on this interface over the cell network.
Allow all outgoing connections on all interfaces

Check if it is running

Firewall service status can be viewed by querying openrc:

$ sudo rc-service nftables status
 * status: started

If the status is not started, the kernel may not have support for nftables (see #Configuring the kernel to support nftables).

The currently loaded set of rules can be viewed with:

$ sudo nft list ruleset
table inet filter {
        chain input {
                type filter hook input priority filter; policy drop;
.....

Usage

The nftables openrc init script controls loading the firewall on boot. This service can be disabled to disable the firewall, or enabled to re-enable it:

$ sudo rc-update add nftables  # enable firewall on boot

$ sudo rc-update del nftables  # disable firewall on boot

Additional rules can be added in /etc/nftables.d. The following packages are available in pmaports to add additional rules/functionality:

* postmarketos-config-nftables-openusb
Adds rule to allow all incoming connections over the USB networking interface, useful for debugging pmOS, but not recommended for normal use.
* postmarketos-config-nftables-log
Adds rules to enable logging of incoming and dropped connections to the firewall, useful for debugging firewall-related connection issues. This may generate a lot of messages in syslog.

Configuring the kernel to support nftables

  • Run pmbootstrap kconfig check --nftables kernel-package-name to get a list of kernel config options that need to be changed
  • Fix them up with pmbootstrap kconfig edit
  • Add pmb:kconfigcheck-nftables to options= in your kernel's APKBUILD
  • Create a test install with pmbootstrap install
  • Boot it and verify that the firewall works
  • Create a merge request to pmaports.git with your changes

Contributing your nftable rules

A key goal of postmarketOS is to be polished. As such, if you install a package and it doesnt work without changing the nftables, you should contribute your nftables to pmaports. Contributing will make it easier to install the package on your other computers and help other postmarketOS users.

If your package is not part of the default install, you probably dont want to enable the rule for users that have not installed the package. As such, you can use install_if="$pkgname <PACKAGE>" in the nftable subpackage to only install the nftable if <PACKAGE> is installed on the user's machine. For more information about if_install, install the abuild-doc package and read man APKBUILD.

Examples of custom nftables:

Also see:

See also