From 39d40517a25a8efacdc80e34a28868b13c3a3cc8 Mon Sep 17 00:00:00 2001 From: Robin Reckmann Date: Wed, 22 Apr 2026 00:00:51 +0900 Subject: [PATCH 1/2] system: replace legacy iptables with nftables --- kernel/configs/vamos.config | 4 +++ tools/build/Dockerfile | 8 +----- userspace/base_setup.sh | 1 + userspace/root/etc/iptables/rules.v4 | 39 ---------------------------- userspace/root/etc/nftables.conf | 14 ++++++++++ 5 files changed, 20 insertions(+), 46 deletions(-) delete mode 100644 userspace/root/etc/iptables/rules.v4 create mode 100644 userspace/root/etc/nftables.conf diff --git a/kernel/configs/vamos.config b/kernel/configs/vamos.config index eb5c3927..aa9fa4fc 100644 --- a/kernel/configs/vamos.config +++ b/kernel/configs/vamos.config @@ -30,6 +30,10 @@ CONFIG_USB_SERIAL_OPTION=y # Networking CONFIG_IPV6=y +CONFIG_NF_CONNTRACK=y +CONFIG_NF_TABLES=y +CONFIG_NF_TABLES_INET=y +CONFIG_NFT_CT=y # Bluetooth CONFIG_BT=y diff --git a/tools/build/Dockerfile b/tools/build/Dockerfile index e52e870e..703ee723 100644 --- a/tools/build/Dockerfile +++ b/tools/build/Dockerfile @@ -91,7 +91,7 @@ RUN for svc in \ qrtr-ns rmtfs tqftpserv pd-mapper \ comma modemmanager bluetoothd magic \ ssh-param-watcher ncm-param-watcher dnsmasq \ - rsyslogd iptables polkitd \ + rsyslogd nftables polkitd \ agetty-ttyMSM0 agetty-ttyAMA0; do \ ln -sf /etc/sv/$svc /etc/runit/runsvdir/default/; \ done @@ -115,9 +115,6 @@ RUN chmod +x /usr/local/sbin/poweroff && \ # NetworkManager connection permissions RUN chmod 600 /usr/lib/NetworkManager/system-connections/*.nmconnection -# Void's iptables service expects iptables.rules -RUN ln -s /etc/iptables/rules.v4 /etc/iptables/iptables.rules - # MOTD - profile.d runs update-motd.d scripts into /run/motd, pam_motd displays it RUN sed -i 's|motd=/etc/motd|motd=/run/motd|' /etc/pam.d/system-login @@ -215,9 +212,6 @@ RUN echo '#!/bin/sh' > /etc/sv/sshd/run && \ echo 'fi' >> /etc/sv/sshd/run && \ echo 'exec /usr/bin/sshd -D' >> /etc/sv/sshd/run -# DEBUG: Fix iptables to allow SSH (insert before wwan0 DROP rule) -RUN sed -i '/-A INPUT -i wwan0 -j DROP/i -A INPUT -p tcp --dport 22 -j ACCEPT' /etc/iptables/rules.v4 || true - RUN ldconfig # Note: /data mount is handled in runit stage 1 (/etc/runit/1) diff --git a/userspace/base_setup.sh b/userspace/base_setup.sh index 982688cc..7cfd5ba5 100755 --- a/userspace/base_setup.sh +++ b/userspace/base_setup.sh @@ -76,6 +76,7 @@ xbps-install -y \ net-tools \ NetworkManager \ nload \ + nftables \ opencl-headers \ portaudio-devel \ ppp \ diff --git a/userspace/root/etc/iptables/rules.v4 b/userspace/root/etc/iptables/rules.v4 deleted file mode 100644 index f1361582..00000000 --- a/userspace/root/etc/iptables/rules.v4 +++ /dev/null @@ -1,39 +0,0 @@ -# Generated by iptables-save v1.8.4 on Thu May 26 16:34:33 2022 -*security -:INPUT ACCEPT [232864:1793459837] -:FORWARD ACCEPT [0:0] -:OUTPUT ACCEPT [205236:11113001] -COMMIT -# Completed on Thu May 26 16:34:33 2022 -# Generated by iptables-save v1.8.4 on Thu May 26 16:34:33 2022 -*raw -:PREROUTING ACCEPT [232873:1793461973] -:OUTPUT ACCEPT [205236:11113001] -COMMIT -# Completed on Thu May 26 16:34:33 2022 -# Generated by iptables-save v1.8.4 on Thu May 26 16:34:33 2022 -*nat -:PREROUTING ACCEPT [92:10264] -:INPUT ACCEPT [83:8128] -:OUTPUT ACCEPT [281:20487] -:POSTROUTING ACCEPT [281:20487] -COMMIT -# Completed on Thu May 26 16:34:33 2022 -# Generated by iptables-save v1.8.4 on Thu May 26 16:34:33 2022 -*mangle -:PREROUTING ACCEPT [232873:1793461973] -:INPUT ACCEPT [232864:1793459837] -:FORWARD ACCEPT [0:0] -:OUTPUT ACCEPT [205236:11113001] -:POSTROUTING ACCEPT [205236:11113001] -COMMIT -# Completed on Thu May 26 16:34:33 2022 -# Generated by iptables-save v1.8.4 on Thu May 26 16:34:33 2022 -*filter -:INPUT ACCEPT [16:2193] -:FORWARD ACCEPT [0:0] -:OUTPUT ACCEPT [108:15364] --A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT --A INPUT -i wwan0 -j DROP -COMMIT -# Completed on Thu May 26 16:34:33 2022 diff --git a/userspace/root/etc/nftables.conf b/userspace/root/etc/nftables.conf new file mode 100644 index 00000000..bdca5071 --- /dev/null +++ b/userspace/root/etc/nftables.conf @@ -0,0 +1,14 @@ +#!/usr/sbin/nft -f + +flush ruleset + +table inet filter { + chain input { + type filter hook input priority filter; + policy accept; + + ct state established,related accept + tcp dport 22 accept + iifname "wwan0" drop + } +} From 33a8f0426af2ffacf48dad78cb02a9d37471a1c6 Mon Sep 17 00:00:00 2001 From: Robin Reckmann Date: Wed, 8 Jul 2026 21:45:19 +0900 Subject: [PATCH 2/2] remove debug port 22 exception --- userspace/root/etc/nftables.conf | 1 - 1 file changed, 1 deletion(-) diff --git a/userspace/root/etc/nftables.conf b/userspace/root/etc/nftables.conf index bdca5071..c513b462 100644 --- a/userspace/root/etc/nftables.conf +++ b/userspace/root/etc/nftables.conf @@ -8,7 +8,6 @@ table inet filter { policy accept; ct state established,related accept - tcp dport 22 accept iifname "wwan0" drop } }