forge/pmaports
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions
pmaports/main/postmarketos-config-nftables/APKBUILD

114 lines
3.9 KiB
Text
Raw Normal View History

postmarketos-config-nftables: add package for configuring nftables fw (MR 2060) Installs nftables config useful for pmOS:: 1) drop all connections to wwan* (wildcard matching supported, are there any other wwan iface names that wouldn't match this?) 2) allow ssh, drop from wwan (kinda redundant w/ the first rule, but doesn't hurt..), allow DHCP on usb* 3) allow all incoming connections on usb* (with the -openusb subpackage) 4) enable logging all nftable events (with the -log subpackage), very useful for debugging fixes #1024
2021-03-26 02:59:23 +00:00
# Maintainer: Clayton Craft <clayton@craftyguy.net>
pkgname=postmarketos-config-nftables
postmarketos-config-nftables: add upnp-client rules (MR 3533) Add rules to accept SSDP/UPnP Replies, which can be used for discovery in VLC.
2022-10-13 09:07:50 +00:00
pkgver=0.11
postmarketos-config-nftables: fix syntax errors and coding styles (MR 3535)
2022-10-13 20:08:54 +00:00
pkgrel=1
postmarketos-config-nftables: add package for configuring nftables fw (MR 2060) Installs nftables config useful for pmOS:: 1) drop all connections to wwan* (wildcard matching supported, are there any other wwan iface names that wouldn't match this?) 2) allow ssh, drop from wwan (kinda redundant w/ the first rule, but doesn't hurt..), allow DHCP on usb* 3) allow all incoming connections on usb* (with the -openusb subpackage) 4) enable logging all nftable events (with the -log subpackage), very useful for debugging fixes #1024
2021-03-26 02:59:23 +00:00
pkgdesc="nftables firewall configuration for postmarketOS"
url="https://gitlab.com/postmarketos"
arch="noarch"
license="MIT"
depends="nftables-openrc"
main/postmarketos-config-nftables: fix hotspot with networkmanager (MR 2408) The networkmanager hotspot needs to have DHCP input enabled on the wifi interfaces so the temporary dnsmasq instance can work. The networkmanager backend is also switched to the nftables one so it can create the ad-hoc hotspot forwarding/masquerade table.
2021-08-05 21:37:09 +00:00
subpackages="
$pkgname-openusb:openusb
$pkgname-log:log
main/postmarketos-config-nftables: subpackage docker (MR 2629)
2021-10-24 00:54:16 +00:00
$pkgname-docker:docker
main/postmarketos-config-nftables: add mosh config (MR 2725) https://social.linux.pizza/@jan_wagemakers/107393948283025525 [ci:skip-build] already built successfully in CI
2021-12-05 20:25:43 +00:00
$pkgname-moshserver:moshserver
main/postmarketos-config-nftables: fix hotspot with networkmanager (MR 2408) The networkmanager hotspot needs to have DHCP input enabled on the wifi interfaces so the temporary dnsmasq instance can work. The networkmanager backend is also switched to the nftables one so it can create the ad-hoc hotspot forwarding/masquerade table.
2021-08-05 21:37:09 +00:00
$pkgname-networkmanager:networkmanager
postmarketos-config-nftables: add upnp-client rules (MR 3533) Add rules to accept SSDP/UPnP Replies, which can be used for discovery in VLC.
2022-10-13 09:07:50 +00:00
$pkgname-upnp-client:upnp_client
main/postmarketos-config-nftables: subpackage vncserver (MR 2479) Co-authored-by: clayton craft <clayton@craftyguy.net>
2021-09-01 04:53:27 +00:00
$pkgname-vncserver:vncserver
main/postmarketos-config-nftables: fix hotspot with networkmanager (MR 2408) The networkmanager hotspot needs to have DHCP input enabled on the wifi interfaces so the temporary dnsmasq instance can work. The networkmanager backend is also switched to the nftables one so it can create the ad-hoc hotspot forwarding/masquerade table.
2021-08-05 21:37:09 +00:00
"
postmarketos-config-nftables: add package for configuring nftables fw (MR 2060) Installs nftables config useful for pmOS:: 1) drop all connections to wwan* (wildcard matching supported, are there any other wwan iface names that wouldn't match this?) 2) allow ssh, drop from wwan (kinda redundant w/ the first rule, but doesn't hurt..), allow DHCP on usb* 3) allow all incoming connections on usb* (with the -openusb subpackage) 4) enable logging all nftable events (with the -log subpackage), very useful for debugging fixes #1024
2021-03-26 02:59:23 +00:00
source="
rules/00_log_all.nft
rules/01_wwan.nft
rules/10_dhcp.nft
rules/50_ssh.nft
postmarketos-config-nftables: add upnp-client rules (MR 3533) Add rules to accept SSDP/UPnP Replies, which can be used for discovery in VLC.
2022-10-13 09:07:50 +00:00
rules/50_upnp_client.nft
rules/50_vncserver.nft
main/postmarketos-config-nftables: subpackage docker (MR 2629)
2021-10-24 00:54:16 +00:00
rules/51_docker.nft
main/postmarketos-config-nftables: add mosh config (MR 2725) https://social.linux.pizza/@jan_wagemakers/107393948283025525 [ci:skip-build] already built successfully in CI
2021-12-05 20:25:43 +00:00
rules/51_moshserver.nft
postmarketos-config-nftables: allow DNS from wlan* (MR 2448) This fixes DNS when a system is connected to a pmOS device as a hotspot. The rule is in the default set of firewall rules, instead of a subpackage.. I think this is OK. I don't believe anything should be listening on port 53 except when the hotspot is running...
2021-08-18 00:06:56 +00:00
rules/51_hotspot.nft
config-nftables: add rules for allowing usb inet access (MR 2274) This rule is installed by default, since users that need usb inet won't have an easy way to install a subpackage. This is meant to facilitate: https://wiki.postmarketos.org/wiki/USB_Internet
2021-06-24 23:45:12 +00:00
rules/51_usb_inet.nft
postmarketos-config-nftables: add package for configuring nftables fw (MR 2060) Installs nftables config useful for pmOS:: 1) drop all connections to wwan* (wildcard matching supported, are there any other wwan iface names that wouldn't match this?) 2) allow ssh, drop from wwan (kinda redundant w/ the first rule, but doesn't hurt..), allow DHCP on usb* 3) allow all incoming connections on usb* (with the -openusb subpackage) 4) enable logging all nftable events (with the -log subpackage), very useful for debugging fixes #1024
2021-03-26 02:59:23 +00:00
rules/60_usb.nft
rules/99_drop_log.nft
main/postmarketos-config-nftables: fix hotspot with networkmanager (MR 2408) The networkmanager hotspot needs to have DHCP input enabled on the wifi interfaces so the temporary dnsmasq instance can work. The networkmanager backend is also switched to the nftables one so it can create the ad-hoc hotspot forwarding/masquerade table.
2021-08-05 21:37:09 +00:00
networkmanager.conf
postmarketos-config-nftables: add package for configuring nftables fw (MR 2060) Installs nftables config useful for pmOS:: 1) drop all connections to wwan* (wildcard matching supported, are there any other wwan iface names that wouldn't match this?) 2) allow ssh, drop from wwan (kinda redundant w/ the first rule, but doesn't hurt..), allow DHCP on usb* 3) allow all incoming connections on usb* (with the -openusb subpackage) 4) enable logging all nftable events (with the -log subpackage), very useful for debugging fixes #1024
2021-03-26 02:59:23 +00:00
"
options="!check" # No tests
install="$pkgname.post-install"
package() {
cd rules
for _i in ./*; do
install -Dm644 "$_i" "$pkgdir"/etc/nftables.d/"$_i"
done
}
openusb() {
depends="$pkgname"
description="Adds a rule to accept all incoming connections to the usb* interface"
amove etc/nftables.d/60_usb.nft
}
log() {
depends="$pkgname"
description="Enables logging of nftable events"
amove etc/nftables.d/00_log_all.nft
amove etc/nftables.d/99_drop_log.nft
}
main/postmarketos-config-nftables: subpackage docker (MR 2629)
2021-10-24 00:54:16 +00:00
docker() {
depends="$pkgname"
description="Enables networking for Docker"
install_if="$pkgname docker"
amove etc/nftables.d/51_docker.nft
}
main/postmarketos-config-nftables: add mosh config (MR 2725) https://social.linux.pizza/@jan_wagemakers/107393948283025525 [ci:skip-build] already built successfully in CI
2021-12-05 20:25:43 +00:00
moshserver() {
depends="$pkgname"
description="Enables networking for mosh server"
install_if="$pkgname=$pkgver-r$pkgrel mosh-server"
amove etc/nftables.d/51_moshserver.nft
}
postmarketos-config-nftables: add upnp-client rules (MR 3533) Add rules to accept SSDP/UPnP Replies, which can be used for discovery in VLC.
2022-10-13 09:07:50 +00:00
upnp_client() {
depends="$pkgname"
description="Enables networking for SSDP/UPnP client"
install_if="$pkgname libupnp"
amove etc/nftables.d/50_upnp_client.nft
}
main/postmarketos-config-nftables: subpackage vncserver (MR 2479) Co-authored-by: clayton craft <clayton@craftyguy.net>
2021-09-01 04:53:27 +00:00
vncserver() {
depends="$pkgname"
description="Enables networking for VNC Server"
amove etc/nftables.d/50_vncserver.nft
}
main/postmarketos-config-nftables: fix hotspot with networkmanager (MR 2408) The networkmanager hotspot needs to have DHCP input enabled on the wifi interfaces so the temporary dnsmasq instance can work. The networkmanager backend is also switched to the nftables one so it can create the ad-hoc hotspot forwarding/masquerade table.
2021-08-05 21:37:09 +00:00
networkmanager() {
depends="$pkgname"
description="Enables nftables backend in NetworkManager"
install_if="$pkgname networkmanager"
install -Dm644 "$srcdir"/networkmanager.conf \
"$subpkgdir"/etc/NetworkManager/conf.d/nftables.conf
}
postmarketos-config-nftables: add package for configuring nftables fw (MR 2060) Installs nftables config useful for pmOS:: 1) drop all connections to wwan* (wildcard matching supported, are there any other wwan iface names that wouldn't match this?) 2) allow ssh, drop from wwan (kinda redundant w/ the first rule, but doesn't hurt..), allow DHCP on usb* 3) allow all incoming connections on usb* (with the -openusb subpackage) 4) enable logging all nftable events (with the -log subpackage), very useful for debugging fixes #1024
2021-03-26 02:59:23 +00:00
sha512sums="
166d77bcccc85a3db24af85010d07241cf193bccd79064863fbf9da7be4426364e9f9a9e0668c2c8018ada470d0fda30fe8eba24d24a2d4150af1d78af31b9b7 00_log_all.nft
10b3ab4d1f98a669e88fb2113a3880c4bf410d68859fe6a3efe8d638e3060af4a829485aed8c8da226c7fb7a53bab1bc90a659cb8fad9ccd226d808dbba94caf 01_wwan.nft
main/postmarketos-config-nftables: fix hotspot with networkmanager (MR 2408) The networkmanager hotspot needs to have DHCP input enabled on the wifi interfaces so the temporary dnsmasq instance can work. The networkmanager backend is also switched to the nftables one so it can create the ad-hoc hotspot forwarding/masquerade table.
2021-08-05 21:37:09 +00:00
d5a7c7fc47924acfafee42d731e6a0109d83af6278053128deecbf3cf40e37447cb649360ee9ebddd2a5ea276888314b63ce7ef828708b5bf7dd1bface7fbc62 10_dhcp.nft
postmarketos-config-nftables: add package for configuring nftables fw (MR 2060) Installs nftables config useful for pmOS:: 1) drop all connections to wwan* (wildcard matching supported, are there any other wwan iface names that wouldn't match this?) 2) allow ssh, drop from wwan (kinda redundant w/ the first rule, but doesn't hurt..), allow DHCP on usb* 3) allow all incoming connections on usb* (with the -openusb subpackage) 4) enable logging all nftable events (with the -log subpackage), very useful for debugging fixes #1024
2021-03-26 02:59:23 +00:00
6b0d0c7c3368dde1ad61d26a0c2e13008f16d5bedaf11fa4a3511b49675505cbbdda8bf8ff158194846b197108f76bdfd66d40a2afb9f4d25c79b02acf5659b7 50_ssh.nft
postmarketos-config-nftables: fix syntax errors and coding styles (MR 3535)
2022-10-13 20:08:54 +00:00
19f3b7887ed4754d7b0fe9cd1fce9369338520e0598004a0c56ac46c73bc2f721b1bb551689f9b614de6891ca99833ce4586b51a0903c2d00df278c902d11ffa 50_upnp_client.nft
528d474a19bb9dd9f88213d75a0cc2521f6393ba8762a1aed4f79a49ba75a551047b83950f9effa5d6c928952b88f6c642a087ce4d9696457967a86f52ae5632 50_vncserver.nft
main/postmarketos-config-nftables: subpackage docker (MR 2629)
2021-10-24 00:54:16 +00:00
76ac156ee80f895ab4f574f70f4ee9f960dfd23a3381bbbf7c744bea919b98f69e91e2eaa10425dfeaf5dbe77b745ec1dd82cb94953835873baffd9e5d89e166 51_docker.nft
main/postmarketos-config-nftables: add mosh config (MR 2725) https://social.linux.pizza/@jan_wagemakers/107393948283025525 [ci:skip-build] already built successfully in CI
2021-12-05 20:25:43 +00:00
59d93d0006aadb6f699836895119cf49a2fbbc1159cad4ab98868610cd6796da7fe792e7c845df93303a4cfa77658e0687b6726a8b0bcf613563f1a33d5588ab 51_moshserver.nft
postmarketos-config-nftables: add forward rule to accept traffic on wlan (MR 2622) This seems to fix the last missing piece to getting the hotspot stuff working, at least when it's set up with networkmanager (I haven't tested other methods, but assume this rule is still needed there too...) fixes #1198
2021-10-22 06:33:30 +00:00
1ce70bb71c9008b6c727a2c26d11467be3b5a0cb9815a8bb0790150c7958457b22b110e35ba974973b9579d44bd14219985d85597c954b5fa8cf77bf206c959b 51_hotspot.nft
postmarketos-config-nftables: fix syntax errors and coding styles (MR 3535)
2022-10-13 20:08:54 +00:00
ea7d8a652808ba6ae92de6dfc9f7d57415e411a04db3a41d1480f254b3a3a574558dbee2e7259e5d527527a11ca3aace7bb9edc7e023b0f4f67afceefeeb9e88 51_usb_inet.nft
postmarketos-config-nftables: add package for configuring nftables fw (MR 2060) Installs nftables config useful for pmOS:: 1) drop all connections to wwan* (wildcard matching supported, are there any other wwan iface names that wouldn't match this?) 2) allow ssh, drop from wwan (kinda redundant w/ the first rule, but doesn't hurt..), allow DHCP on usb* 3) allow all incoming connections on usb* (with the -openusb subpackage) 4) enable logging all nftable events (with the -log subpackage), very useful for debugging fixes #1024
2021-03-26 02:59:23 +00:00
0e86974602622c03f0b34acd048e3a31157c0226ab4b5ec093a19696af3fc9637ed84cecf0d190941e4bd3afeb0c76a37245fa850abef46778cd1235ad8106df 60_usb.nft
1532899534d7432a7708620cf1053ab80635fffe038a2352eb890c35fba4247c3b9ab3d0b028da1be765e5feb9b5a5b3a8107f4aa79f790d17930d38535a2288 99_drop_log.nft
main/postmarketos-config-nftables: fix hotspot with networkmanager (MR 2408) The networkmanager hotspot needs to have DHCP input enabled on the wifi interfaces so the temporary dnsmasq instance can work. The networkmanager backend is also switched to the nftables one so it can create the ad-hoc hotspot forwarding/masquerade table.
2021-08-05 21:37:09 +00:00
ea738469e68b8a8038f301b0cb901cd305445321ee24c4b4025365b4b95d5c61113a5bb24ab4efaa73eda23c2e06984d3e58395584fcb8887cf1595ea99542da networkmanager.conf
postmarketos-config-nftables: add package for configuring nftables fw (MR 2060) Installs nftables config useful for pmOS:: 1) drop all connections to wwan* (wildcard matching supported, are there any other wwan iface names that wouldn't match this?) 2) allow ssh, drop from wwan (kinda redundant w/ the first rule, but doesn't hurt..), allow DHCP on usb* 3) allow all incoming connections on usb* (with the -openusb subpackage) 4) enable logging all nftable events (with the -log subpackage), very useful for debugging fixes #1024
2021-03-26 02:59:23 +00:00
"
Reference in a new issue Copy permalink