nftables

nftables is a newer replacement for iptables, ip6tables, arptables and ebtables. It has a serialisation format for defining rules and it supports using the same rulefile for IPv4 and IPv6.

The first kernel with nftables support is 3.13

Installing

The kernel on the device needs to have the kconfig options enabled for nftables, the main options for this are CONFIG_NF_TABLES and CONFIG_NF_TABLES_INET.

The userspace part is in the Alpine package nftables which provides the nftables openrc service and the nft command to do runtime changes.

# apk add nftables
# rc-update add nftables
# service nftables list
table inet filter {
    chain input {
...

The default configuration when adding the nftables package and enabling the service will drop all incoming connections and blocks no outbound connections. It will also ratelimit incoming icmp packets. This config is stored in /etc/nftables.nft and will include any ruleset files that are put in /etc/nftables.d/*.nft. This is a good place to put your own extra rules.

Allowing SSH

Since the default ruleset drops all incoming connections you will no longer be able to SSH into the device after starting the nftables service. To allow connections again you can create an extra ruleset that allows connections over USB networking and over wifi:

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;

        iifname usb0 accept \
        comment "Accept all traffic from USB ethernet"

        iifname "wlan*" tcp dport {ssh} accept \
        comment "Accept SSH over wifi"
    }
}

These rules will be amended to the default ruleset and allow all connections from usb0, which is the network interface created by the usb networking in postmarketOS. The second added rule will allow incoming SSH connections on any interface starting with wlan.

After creating or changing the rules files you can make them active with the reload command on the nftables service:

# service nftables reload

How to disable firewall

# nft flush ruleset
# rc-service nftables stop
# rc-update del nftables default

Logs

Install the postmarketos-config-nftables-log package
Restart the nftables service with sudo rc-service nftables restart
Logs should be available in the kernel through dmesg

More information

the nftables wiki