IP Packet Filter
NuttX supports IP packet filter (firewall) compatible with Linux’s iptables and netfilter. It is a stateless packet filter that can be used to filter packets based on source and destination IP addresses, source and destination ports, protocol, and interface.
Workflow
Similar to Linux’s iptables, NuttX’s IP packet filter defines chains at similar points in the packet processing path. The following diagram shows the packet processing path and the chains that are defined in NuttX’s IP packet filter.
NIC ──> ipv[46]_input ─┬─> ipv[46]_forward ──> [FORWARD CHAIN] ──> devif_poll_out ──> NIC
│ ^
│ ┌─> tcp ─┐ │
│ ├─> udp ─┤ │
└─> [INPUT CHAIN] ─┼─> icmp ─┼─> [OUTPUT CHAIN] ─┘
├─> icmp6 ─┤
└─> ... ─┘
Configuration Options
CONFIG_NET_IPFILTEREnable this option to enable the IP packet filter (firewall).
CONFIG_NET_IPTABLESEnable or disable iptables compatible interface (including ip6tables).
CONFIG_SYSTEM_IPTABLESEnable support for the ‘iptables’ command.
CONFIG_SYSTEM_IP6TABLESEnable support for the ‘ip6tables’ command.
Usage
With iptables command, we can add, delete, and list rules in the IP packet filter. It’s similar to the iptables command in Linux.
The following examples show the commands we support:
> iptables -h
USAGE: iptables -t table -[AD] chain rule-specification
iptables -t table -I chain [rulenum] rule-specification
iptables -t table -D chain rulenum
iptables -t table -P chain target
iptables -t table -[FL] [chain]
Commands:
--append -A chain Append a rule to chain
--insert -I chain [rulenum] Insert a rule to chain at rulenum (default = 1)
--delete -D chain [rulenum] Delete matching rule from chain
--policy -P chain target Set policy for chain to target
--flush -F [chain] Delete all rules in chain or all chains
--list -L [chain] List all rules in chain or all chains
Options:
--table -t table Table to manipulate (default: filter)
--jump -j target Target for rule
[!] --in-interface -i dev Input network interface name
[!] --out-interface -o dev Output network interface name
[!] --source -s address[/mask] Source address
[!] --destination -d address[/mask] Destination address
[!] --protocol -p proto Protocol (tcp, udp, icmp, esp, all)
[!] --source-port,--sport
port[:port] Source port
[!] --destination-port,--dport
port[:port] Destination port
[!] --icmp-type type ICMP type
[!] --icmpv6-type type ICMPv6 type
> iptables -P FORWARD DROP
> iptables -I INPUT -i eth0 ! -p icmp -j DROP
> iptables -t filter -A FORWARD -p tcp -s 10.0.1.2/24 -d 10.0.3.4/24 -i eth0 -o eth1 --sport 3000:3200 --dport 123:65535 -j ACCEPT
> iptables -t filter -I FORWARD 2 -p icmp ! -s 123.123.123.123 ! -i eth0 -o eth1 ! --icmp-type 255 -j REJECT
> iptables -L
Chain INPUT (policy ACCEPT)
target prot idev odev source destination
DROP !icmp eth0 any anywhere anywhere
Chain FORWARD (policy DROP)
target prot idev odev source destination
ACCEPT tcp eth0 eth1 10.0.1.2/24 10.0.3.4/24 tcp spts:3000:3200 dpts:123:65535
REJECT icmp !eth0 eth1 !123.123.123.123/32 anywhere icmp !type 255
Chain OUTPUT (policy ACCEPT)
target prot idev odev source destination
> ip6tables -P FORWARD DROP
> ip6tables -t filter -I FORWARD -p tcp -s fc00::2/64 -d 2001:da8::2:4/64 -i eth0 -o eth1 --sport 3000:3200 --dport 123:65535 -j ACCEPT
> ip6tables -t filter -I FORWARD -p icmpv6 -s fc00::2/64 -d 2001:da8::2:4/64 -i eth0 -o eth1 --icmpv6-type 123 -j ACCEPT
> ip6tables -t filter -I FORWARD -p tcp -i eth0 -o eth1 --sport 3000 -j ACCEPT
> ip6tables -t filter -I FORWARD 1 ! -p tcp ! -s fc00::2/64 ! -d 2001:da8::2:4/64 ! -i eth0 ! -o eth1 ! --sport 3000:3200 ! --dport 0:123 -j DROP
> ip6tables -t filter -I FORWARD 3 ! -p icmpv6 ! -s fc00::2/64 -d 2001:da8::2:4/64 ! -i eth0 -o eth1 ! --icmpv6-type 255 -j REJECT
> ip6tables -L
Chain INPUT (policy ACCEPT)
target prot idev odev source destination
Chain FORWARD (policy DROP)
target prot idev odev source destination
DROP !tcp !eth0 !eth1 !fc00::2/64 !2001:da8::2:4/64 tcp spts:!3000:3200 dpts:!0:123
ACCEPT tcp eth0 eth1 anywhere anywhere tcp spts:3000:3000 dpts:0:65535
REJECT !ipv6-icmp !eth0 eth1 !fc00::2/64 2001:da8::2:4/64 ipv6-icmp !type 255
ACCEPT ipv6-icmp eth0 eth1 fc00::2/64 2001:da8::2:4/64 ipv6-icmp type 123
ACCEPT tcp eth0 eth1 fc00::2/64 2001:da8::2:4/64 tcp spts:3000:3200 dpts:123:65535
Chain OUTPUT (policy ACCEPT)
target prot idev odev source destination