Documentation: Add docs for ipfilter
Signed-off-by: Zhe Weng <wengzhe@xiaomi.com>
This commit is contained in:
Zhe Weng
Xiang Xiao
parent
2c303f213f
commit
38664cee78
@ -8,6 +8,7 @@ Network Support
|
|||||||
sixlowpan.rst
|
sixlowpan.rst
|
||||||
socketcan.rst
|
socketcan.rst
|
||||||
pkt.rst
|
pkt.rst
|
||||||
|
ipfilter.rst
|
||||||
nat.rst
|
nat.rst
|
||||||
netdev.rst
|
netdev.rst
|
||||||
netdriver.rst
|
netdriver.rst
|
||||||
|
|||||||
125
Documentation/components/net/ipfilter.rst
Normal file
125
Documentation/components/net/ipfilter.rst
Normal file
@ -0,0 +1,125 @@
|
|||||||
|
================
|
||||||
|
IP Packet Filter
|
||||||
|
================
|
||||||
|
|
||||||
|
NuttX supports IP packet filter (firewall) compatible with Linux's iptables and
|
||||||
|
netfilter. It is a stateless packet filter that can be used to filter packets
|
||||||
|
based on source and destination IP addresses, source and destination ports,
|
||||||
|
protocol, and interface.
|
||||||
|
|
||||||
|
Workflow
|
||||||
|
========
|
||||||
|
|
||||||
|
Similar to Linux's iptables, NuttX's IP packet filter defines chains at similar
|
||||||
|
points in the packet processing path. The following diagram shows the packet
|
||||||
|
processing path and the chains that are defined in NuttX's IP packet filter.
|
||||||
|
|
||||||
|
::
|
||||||
|
|
||||||
|
NIC ──> ipv[46]_input ─┬─> ipv[46]_forward ──> [FORWARD CHAIN] ──> devif_poll_out ──> NIC
|
||||||
|
│ ^
|
||||||
|
│ ┌─> tcp ─┐ │
|
||||||
|
│ ├─> udp ─┤ │
|
||||||
|
└─> [INPUT CHAIN] ─┼─> icmp ─┼─> [OUTPUT CHAIN] ─┘
|
||||||
|
├─> icmp6 ─┤
|
||||||
|
└─> ... ─┘
|
||||||
|
|
||||||
|
Configuration Options
|
||||||
|
=====================
|
||||||
|
|
||||||
|
``CONFIG_NET_IPFILTER``
|
||||||
|
Enable this option to enable the IP packet filter (firewall).
|
||||||
|
|
||||||
|
``CONFIG_NET_IPTABLES``
|
||||||
|
Enable or disable iptables compatible interface (including ip6tables).
|
||||||
|
|
||||||
|
``CONFIG_SYSTEM_IPTABLES``
|
||||||
|
Enable support for the 'iptables' command.
|
||||||
|
|
||||||
|
``CONFIG_SYSTEM_IP6TABLES``
|
||||||
|
Enable support for the 'ip6tables' command.
|
||||||
|
|
||||||
|
Usage
|
||||||
|
=====
|
||||||
|
|
||||||
|
With `iptables` command, we can add, delete, and list rules in the IP packet
|
||||||
|
filter. It's similar to the `iptables` command in Linux.
|
||||||
|
|
||||||
|
The following examples show the commands we support:
|
||||||
|
|
||||||
|
.. code-block:: shell
|
||||||
|
|
||||||
|
> iptables -h
|
||||||
|
|
||||||
|
USAGE: iptables -t table -[AD] chain rule-specification
|
||||||
|
iptables -t table -I chain [rulenum] rule-specification
|
||||||
|
iptables -t table -D chain rulenum
|
||||||
|
iptables -t table -P chain target
|
||||||
|
iptables -t table -[FL] [chain]
|
||||||
|
|
||||||
|
Commands:
|
||||||
|
--append -A chain Append a rule to chain
|
||||||
|
--insert -I chain [rulenum] Insert a rule to chain at rulenum (default = 1)
|
||||||
|
--delete -D chain [rulenum] Delete matching rule from chain
|
||||||
|
--policy -P chain target Set policy for chain to target
|
||||||
|
--flush -F [chain] Delete all rules in chain or all chains
|
||||||
|
--list -L [chain] List all rules in chain or all chains
|
||||||
|
|
||||||
|
Options:
|
||||||
|
--table -t table Table to manipulate (default: filter)
|
||||||
|
--jump -j target Target for rule
|
||||||
|
[!] --in-interface -i dev Input network interface name
|
||||||
|
[!] --out-interface -o dev Output network interface name
|
||||||
|
[!] --source -s address[/mask] Source address
|
||||||
|
[!] --destination -d address[/mask] Destination address
|
||||||
|
[!] --protocol -p proto Protocol (tcp, udp, icmp, esp, all)
|
||||||
|
[!] --source-port,--sport
|
||||||
|
port[:port] Source port
|
||||||
|
[!] --destination-port,--dport
|
||||||
|
port[:port] Destination port
|
||||||
|
[!] --icmp-type type ICMP type
|
||||||
|
[!] --icmpv6-type type ICMPv6 type
|
||||||
|
|
||||||
|
.. code-block:: shell
|
||||||
|
|
||||||
|
> iptables -P FORWARD DROP
|
||||||
|
> iptables -I INPUT -i eth0 ! -p icmp -j DROP
|
||||||
|
> iptables -t filter -A FORWARD -p tcp -s 10.0.1.2/24 -d 10.0.3.4/24 -i eth0 -o eth1 --sport 3000:3200 --dport 123:65535 -j ACCEPT
|
||||||
|
> iptables -t filter -I FORWARD 2 -p icmp ! -s 123.123.123.123 ! -i eth0 -o eth1 ! --icmp-type 255 -j REJECT
|
||||||
|
|
||||||
|
> iptables -L
|
||||||
|
Chain INPUT (policy ACCEPT)
|
||||||
|
target prot idev odev source destination
|
||||||
|
DROP !icmp eth0 any anywhere anywhere
|
||||||
|
|
||||||
|
Chain FORWARD (policy DROP)
|
||||||
|
target prot idev odev source destination
|
||||||
|
ACCEPT tcp eth0 eth1 10.0.1.2/24 10.0.3.4/24 tcp spts:3000:3200 dpts:123:65535
|
||||||
|
REJECT icmp !eth0 eth1 !123.123.123.123/32 anywhere icmp !type 255
|
||||||
|
|
||||||
|
Chain OUTPUT (policy ACCEPT)
|
||||||
|
target prot idev odev source destination
|
||||||
|
|
||||||
|
.. code-block:: shell
|
||||||
|
|
||||||
|
> ip6tables -P FORWARD DROP
|
||||||
|
> ip6tables -t filter -I FORWARD -p tcp -s fc00::2/64 -d 2001:da8::2:4/64 -i eth0 -o eth1 --sport 3000:3200 --dport 123:65535 -j ACCEPT
|
||||||
|
> ip6tables -t filter -I FORWARD -p icmpv6 -s fc00::2/64 -d 2001:da8::2:4/64 -i eth0 -o eth1 --icmpv6-type 123 -j ACCEPT
|
||||||
|
> ip6tables -t filter -I FORWARD -p tcp -i eth0 -o eth1 --sport 3000 -j ACCEPT
|
||||||
|
> ip6tables -t filter -I FORWARD 1 ! -p tcp ! -s fc00::2/64 ! -d 2001:da8::2:4/64 ! -i eth0 ! -o eth1 ! --sport 3000:3200 ! --dport 0:123 -j DROP
|
||||||
|
> ip6tables -t filter -I FORWARD 3 ! -p icmpv6 ! -s fc00::2/64 -d 2001:da8::2:4/64 ! -i eth0 -o eth1 ! --icmpv6-type 255 -j REJECT
|
||||||
|
|
||||||
|
> ip6tables -L
|
||||||
|
Chain INPUT (policy ACCEPT)
|
||||||
|
target prot idev odev source destination
|
||||||
|
|
||||||
|
Chain FORWARD (policy DROP)
|
||||||
|
target prot idev odev source destination
|
||||||
|
DROP !tcp !eth0 !eth1 !fc00::2/64 !2001:da8::2:4/64 tcp spts:!3000:3200 dpts:!0:123
|
||||||
|
ACCEPT tcp eth0 eth1 anywhere anywhere tcp spts:3000:3000 dpts:0:65535
|
||||||
|
REJECT !ipv6-icmp !eth0 eth1 !fc00::2/64 2001:da8::2:4/64 ipv6-icmp !type 255
|
||||||
|
ACCEPT ipv6-icmp eth0 eth1 fc00::2/64 2001:da8::2:4/64 ipv6-icmp type 123
|
||||||
|
ACCEPT tcp eth0 eth1 fc00::2/64 2001:da8::2:4/64 tcp spts:3000:3200 dpts:123:65535
|
||||||
|
|
||||||
|
Chain OUTPUT (policy ACCEPT)
|
||||||
|
target prot idev odev source destination
|
||||||
Loading…
Reference in New Issue
Block a user