Skip to content

Latest commit

 

History

History
125 lines (97 loc) · 5.57 KB

ipfilter.rst

File metadata and controls

125 lines (97 loc) · 5.57 KB
Raw

IP Packet Filter

NuttX supports IP packet filter (firewall) compatible with Linux's iptables and netfilter. It is a stateless packet filter that can be used to filter packets based on source and destination IP addresses, source and destination ports, protocol, and interface.

Workflow

Similar to Linux's iptables, NuttX's IP packet filter defines chains at similar points in the packet processing path. The following diagram shows the packet processing path and the chains that are defined in NuttX's IP packet filter.

NIC ──> ipv[46]_input ─┬─> ipv[46]_forward ──> [FORWARD CHAIN] ──> devif_poll_out ──> NIC
                       │                                                 ^
                       │                  ┌─>  tcp  ─┐                   │
                       │                  ├─>  udp  ─┤                   │
                       └─> [INPUT CHAIN] ─┼─> icmp  ─┼─> [OUTPUT CHAIN] ─┘
                                          ├─> icmp6 ─┤
                                          └─>  ...  ─┘

Configuration Options

CONFIG_NET_IPFILTER
Enable this option to enable the IP packet filter (firewall).
CONFIG_NET_IPTABLES
Enable or disable iptables compatible interface (including ip6tables).
CONFIG_SYSTEM_IPTABLES
Enable support for the 'iptables' command.
CONFIG_SYSTEM_IP6TABLES
Enable support for the 'ip6tables' command.

Usage

With iptables command, we can add, delete, and list rules in the IP packet filter. It's similar to the iptables command in Linux.

The following examples show the commands we support:

> iptables -h

USAGE: iptables -t table -[AD] chain rule-specification
       iptables -t table -I chain [rulenum] rule-specification
       iptables -t table -D chain rulenum
       iptables -t table -P chain target
       iptables -t table -[FL] [chain]

Commands:
    --append        -A chain            Append a rule to chain
    --insert        -I chain [rulenum]  Insert a rule to chain at rulenum (default = 1)
    --delete        -D chain [rulenum]  Delete matching rule from chain
    --policy        -P chain target     Set policy for chain to target
    --flush         -F [chain]          Delete all rules in chain or all chains
    --list          -L [chain]          List all rules in chain or all chains

Options:
    --table         -t table            Table to manipulate (default: filter)
    --jump          -j target           Target for rule
[!] --in-interface  -i dev              Input network interface name
[!] --out-interface -o dev              Output network interface name
[!] --source        -s address[/mask]   Source address
[!] --destination   -d address[/mask]   Destination address
[!] --protocol      -p proto            Protocol (tcp, udp, icmp, esp, all)
[!] --source-port,--sport
                       port[:port]      Source port
[!] --destination-port,--dport
                       port[:port]      Destination port
[!] --icmp-type        type             ICMP type
[!] --icmpv6-type      type             ICMPv6 type
> iptables -P FORWARD DROP
> iptables -I INPUT -i eth0 ! -p icmp -j DROP
> iptables -t filter -A FORWARD -p tcp -s 10.0.1.2/24 -d 10.0.3.4/24 -i eth0 -o eth1 --sport 3000:3200 --dport 123:65535 -j ACCEPT
> iptables -t filter -I FORWARD 2 -p icmp ! -s 123.123.123.123 ! -i eth0 -o eth1 ! --icmp-type 255 -j REJECT

> iptables -L
Chain INPUT (policy ACCEPT)
target        prot  idev  odev  source              destination
DROP         !icmp  eth0  any   anywhere            anywhere

Chain FORWARD (policy DROP)
target        prot  idev  odev  source              destination
ACCEPT        tcp   eth0  eth1  10.0.1.2/24         10.0.3.4/24        tcp spts:3000:3200 dpts:123:65535
REJECT        icmp !eth0  eth1 !123.123.123.123/32  anywhere           icmp !type 255

Chain OUTPUT (policy ACCEPT)
target        prot  idev  odev  source              destination
> ip6tables -P FORWARD DROP
> ip6tables -t filter -I FORWARD -p tcp -s fc00::2/64 -d 2001:da8::2:4/64 -i eth0 -o eth1 --sport 3000:3200 --dport 123:65535 -j ACCEPT
> ip6tables -t filter -I FORWARD -p icmpv6 -s fc00::2/64 -d 2001:da8::2:4/64 -i eth0 -o eth1 --icmpv6-type 123 -j ACCEPT
> ip6tables -t filter -I FORWARD -p tcp -i eth0 -o eth1 --sport 3000 -j ACCEPT
> ip6tables -t filter -I FORWARD 1 ! -p tcp ! -s fc00::2/64 ! -d 2001:da8::2:4/64 ! -i eth0 ! -o eth1 ! --sport 3000:3200 ! --dport 0:123 -j DROP
> ip6tables -t filter -I FORWARD 3 ! -p icmpv6 ! -s fc00::2/64 -d 2001:da8::2:4/64 ! -i eth0 -o eth1 ! --icmpv6-type 255 -j REJECT

> ip6tables -L
Chain INPUT (policy ACCEPT)
target        prot  idev  odev  source              destination

Chain FORWARD (policy DROP)
target        prot  idev  odev  source              destination
DROP         !tcp  !eth0 !eth1 !fc00::2/64         !2001:da8::2:4/64   tcp spts:!3000:3200 dpts:!0:123
ACCEPT        tcp   eth0  eth1  anywhere            anywhere           tcp spts:3000:3000 dpts:0:65535
REJECT       !ipv6-icmp !eth0  eth1 !fc00::2/64          2001:da8::2:4/64   ipv6-icmp !type 255
ACCEPT        ipv6-icmp  eth0  eth1  fc00::2/64          2001:da8::2:4/64   ipv6-icmp type 123
ACCEPT        tcp   eth0  eth1  fc00::2/64          2001:da8::2:4/64   tcp spts:3000:3200 dpts:123:65535

Chain OUTPUT (policy ACCEPT)
target        prot  idev  odev  source              destination