Table of Contents
- Firewall
- Usage Syntax
- Getting Help
- Commands
-
Common Use Cases
- Scenario 1: Disable a cellular modem interface
- Scenario 2: Block SSH on one interface but keep it on another
- Scenario 3: Prevent outbound connections on specific ports
- Scenario 4: Block SSH on one interface but allow on another
- Scenario 5: Close a service temporarily
- Scenario 6: Block while preserving SSH session
- Scenario 7: Reset firewall to default (emergency)
- Scenario 8: Combining multiple rules
- Verification Commands
- Important Notes
- Saving configuration
- Examples Summary
- Summary
Firewall
On the D7, the iptables-wrapper.sh shell script is used to manage firewall. This is a BusyBox compatible wrapper script for managing iptables rules and handles common firewall operations. All rules are automatically saved after each operation.
By default all traffic, inbound and outbound, on wwan0 (4G Module) is denied. All other traffic is enabled by default.
Some of the key features of the script include:
- Block/unblock network interfaces
- Block/unblock ports (TCP, UDP, or both)
- Control traffic direction (inbound, outbound, or both)
- Smart blocking mode (preserves routing when interfaces share subnets)
- Automatic rule persistence (saves to /etc/iptables/iptables.rules)
- Flush all rules command
- IPv4 support
Note: The script should be run as root.
Usage Syntax
Getting Help
Commands
Block interface
Syntax:
Behavior:
- Normal mode: This is the mode chosen when there is no option specified and if the interface is assigned an IP address.
This mode blocks traffic TO and FROM the interface's IP address but preserves routing through the interface (smart blocking). This prevents issues when there are multiple interfaces on the same subnet. - Local only mode: This is the mode chosen when the option --local-only is specified. This mode blocks all NEW connections.
Existing connections are preserved and established connections are allowed to continue. - Fallback mode: If no option is specified and if the interface has no IP address, uses full interface blocking.
Blocks ALL traffic on the interface (input, output, forward).
Examples:
What happens:
Understanding smart blocking
Traditional interface blocking on an interface, say eth0, blocks all incoming and outgoing traffic via eth0 (because of the rules: -i eth0 -j DROP and -o eth0 -j DROP). This breaks SSH to eth1 because reply packets route through eth0.
The solution is to use smart blocking:
Smart blocking combines interface AND IP matching:
This blocks:
- Packets TO 192.168.2.100 arriving on eth0
- Packets FROM 192.168.2.100 leaving via eth0
- But allows packets from eth1, with IP 192.168.2.101 to route through eth0.
Unblock interface
Syntax:
Behavior:
- Removes ALL blocking rules for the specified interface
- Handles both smart blocking and full blocking rules
- Handles both IP-based and interface-based rules
- Removes stateful rules (NEW connections)
Examples:
What happens:
- Iteratively removes all matching DROP rules
- Removes interface-based rules (-i/-o)
- Removes IP-based rules (-s/-d)
- Removes stateful rules (-m state –state NEW)
Block Port
Syntax:
Options:
- -d, --direction <in|out|both> - Traffic direction (default: both)
- -p, --protocol <tcp|udp|both> - Protocol (default: both)
- -i, --interface <interface> - Specific interface (optional)
Behavior:
- Blocks the specified port for the given protocol and direction
- Optionally limits the block to a specific network interface
- Default behavior blocks both directions and both protocols on all interfaces
- Uses DROP target (silently discards packets)
Examples:
What happens:
For block-port 8080 -d in -p tcp:
For block-port 22 -d in -p tcp -i eth0:
For block-port 53 -d both -p both -i wwan0:
Unblock Port
Syntax:
Options:
- -d, --direction <in|out|both> - Traffic direction (default: both)
- -p, --protocol <tcp|udp|both> - Protocol (default: both)
- -i, --interface <interface> - Specific interface (optional)
Behavior:
- Removes blocking rules for the specified port
- Must match the same direction, protocol, and interface used when blocking
- Silently ignores if rule doesn't exist
Examples:
Flush All Rules
Syntax:
Behavior:
- Removes ALL iptables rules from all chains
- Clears custom chains
- Sets all default policies to ACCEPT
- Saves the empty ruleset after flushing
- No confirmation prompt - executes immediately
Examples:
What happens:
- All filter rules deleted
- All NAT rules deleted (if any)
- All mangle rules deleted (if any)
- Custom chains removed
- Default policies: INPUT=ACCEPT, OUTPUT=ACCEPT, FORWARD=ACCEPT
- Clean slate saved to /etc/iptables/iptables.rules
- Important
- This command removes ALL firewall protection immediately without confirmation. Use with caution, especially on production systems.
Common Use Cases
Scenario 1: Disable a cellular modem interface
Scenario 2: Block SSH on one interface but keep it on another
When you have eth0 (192.168.2.100) and eth1 (192.168.2.101):
Scenario 3: Prevent outbound connections on specific ports
Scenario 4: Block SSH on one interface but allow on another
Scenario 5: Close a service temporarily
Scenario 6: Block while preserving SSH session
Scenario 7: Reset firewall to default (emergency)
Scenario 8: Combining multiple rules
Verification Commands
After applying firewall rules, verify using:
Check active rules
Test connectivity
Important Notes
Rule Persistence
Rules are automatically saved to /etc/iptables/iptables.rules after each operation. To ensure rules are restored on boot, setup automatic restoration using the command:
Default Policies
The script does NOT change default policies (ACCEPT). It only adds DROP rules.
Check default policies:
Rule Order
iptables processes rules in order (first match wins). This script inserts rules at the top, using -I, so they take precedence. Existing rules remain and are evaluated after these rules.
Connection Tracking
When using --local-only mode, the script uses connection tracking (-m state --state NEW). This requires the conntrack kernel module.
Saving configuration
It is recommended to use a development image to configure firewall initially.
Once you are happy with your networking rules, copy the file /etc/iptables/iptables.rules. These files can be placed in the /app/sys/etc/iptables/ overlay and can be added to your packaged project. See more details swugen.
For persistence between updates, the configuration files can be placed in /appdata/sys/etc/iptables/. For more details on the supported overlays see Overlays.
Be aware that both /app/sys/etc and /appdata/sys/etc are overlayed on top of /etc. The overlay from /appdata takes precedence over /app. See Overlays for more details regarding precedence and when to use /appdata or /app.
Note: The wrapper script does not support IPv6 firewall and running the script does not modify /etc/iptables/ip6tables.rules.
Examples Summary
| Action | Command |
|---|---|
| Block interface (smart) | ./iptables-wrapper.sh block-interface eth0 |
| Block interface (preserve SSH) | ./iptables-wrapper.sh block-interface eth0 --local-only |
| Unblock interface | ./iptables-wrapper.sh unblock-interface eth0 |
| Block port (all) | ./iptables-wrapper.sh block-port 8080 |
| Block port (TCP in) | ./iptables-wrapper.sh block-port 22 -d in -p tcp |
| Block port (UDP out) | ./iptables-wrapper.sh block-port 53 -d out -p udp |
| Block port on interface | ./iptables-wrapper.sh block-port 22 -d in -p tcp -i eth0 |
| Unblock port | ./iptables-wrapper.sh unblock-port 8080 |
| Unblock port on interface | ./iptables-wrapper.sh unblock-port 22 -i eth0 |
| Flush all rules | ./iptables-wrapper.sh flush |
| View rules | iptables -L -v -n |
| View with line numbers | iptables -L INPUT -v -n --line-numbers |
| Restore saved rules | iptables-restore < /etc/iptables/iptables.rules |
Summary
On this page, we have described the firewall used on the D7. This concludes SDK usage on the D7 target. The next steps describe how to build and run QML and CLI applications on your chosen host system after installing Qt.
Generated by
1.14.0