From 095bbb3fa949e7e4173cea01063b0eb4ad8c08f8 Mon Sep 17 00:00:00 2001 From: Adeeb Shihadeh Date: Thu, 26 May 2022 17:22:27 -0700 Subject: [PATCH] iptables: block incoming wwan0 traffic (#67) * iptables: block incoming wwan0 traffic (#45) * allow related Co-authored-by: Willem Melching --- Dockerfile.agnos | 3 +++ userspace/base_setup.sh | 1 + userspace/etc/iptables/rules.v4 | 39 +++++++++++++++++++++++++++++++++ 3 files changed, 43 insertions(+) create mode 100644 userspace/etc/iptables/rules.v4 diff --git a/Dockerfile.agnos b/Dockerfile.agnos index 223de42..95270f9 100644 --- a/Dockerfile.agnos +++ b/Dockerfile.agnos @@ -171,6 +171,9 @@ COPY ./userspace/files/disable_bootkick.py /lib/systemd/system-shutdown/ # Remove qt network bearer plugins RUN rm -rf /usr/lib/aarch64-linux-gnu/qt5/plugins/bearer +# Add iptable rules to block incoming traffic on wwan0 +COPY ./userspace/etc/iptables/rules.v4 /etc/iptables/rules.v4 + # HACK: get newer version of ModemManager and libqmi from 21.04 # ModemManager 1.12.8 suffers from a bug with reconnecting: https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/issues/242 # libqmi 1.24.8 segfaults when power cycling the modem: https://gitlab.freedesktop.org/mobile-broadband/libqmi/-/issues/37 diff --git a/userspace/base_setup.sh b/userspace/base_setup.sh index 3da2b62..d65c924 100755 --- a/userspace/base_setup.sh +++ b/userspace/base_setup.sh @@ -64,6 +64,7 @@ apt-get install --no-install-recommends -yq \ i2c-tools \ ifmetric \ ifupdown \ + iptables-persistent \ jq \ landscape-common \ libi2c-dev \ diff --git a/userspace/etc/iptables/rules.v4 b/userspace/etc/iptables/rules.v4 new file mode 100644 index 0000000..f136158 --- /dev/null +++ b/userspace/etc/iptables/rules.v4 @@ -0,0 +1,39 @@ +# Generated by iptables-save v1.8.4 on Thu May 26 16:34:33 2022 +*security +:INPUT ACCEPT [232864:1793459837] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [205236:11113001] +COMMIT +# Completed on Thu May 26 16:34:33 2022 +# Generated by iptables-save v1.8.4 on Thu May 26 16:34:33 2022 +*raw +:PREROUTING ACCEPT [232873:1793461973] +:OUTPUT ACCEPT [205236:11113001] +COMMIT +# Completed on Thu May 26 16:34:33 2022 +# Generated by iptables-save v1.8.4 on Thu May 26 16:34:33 2022 +*nat +:PREROUTING ACCEPT [92:10264] +:INPUT ACCEPT [83:8128] +:OUTPUT ACCEPT [281:20487] +:POSTROUTING ACCEPT [281:20487] +COMMIT +# Completed on Thu May 26 16:34:33 2022 +# Generated by iptables-save v1.8.4 on Thu May 26 16:34:33 2022 +*mangle +:PREROUTING ACCEPT [232873:1793461973] +:INPUT ACCEPT [232864:1793459837] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [205236:11113001] +:POSTROUTING ACCEPT [205236:11113001] +COMMIT +# Completed on Thu May 26 16:34:33 2022 +# Generated by iptables-save v1.8.4 on Thu May 26 16:34:33 2022 +*filter +:INPUT ACCEPT [16:2193] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [108:15364] +-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT +-A INPUT -i wwan0 -j DROP +COMMIT +# Completed on Thu May 26 16:34:33 2022