• OpenWRT Bridge Firewalling

    07/17/2016 at 22:27 3 comments

    I configured my OpenVPN to connect 2 network at layer 2. Since broadcast goes across the tunnel and the 2 network have their own dhcp server for their respective gateway. The dhcp packet should be filtered.

    iptables -I zone_lan_forward -o br-lan -m physdev --physdev-out tap0 -p udp --dport 67:68 --sport 67:68 -j REJECT
    iptables -I zone_lan_forward -i br-lan -m physdev --physdev-in tap0 -p udp --dport 67:68 --sport 67:68 -j REJECT

    The system should be configured to enable bridge firewalling in /etc/sysctrl.config

    net.bridge.bridge-nf-call-iptables=1
    I configured the above setting on my custom OpenWRT 15.05 image and run into some issues.
    sysctl: error: 'net.bridge.bridge-nf-call-iptables' is an unknown key
    xt_physdev: Unknown symbol br_netfilter_enable (err 0)
    nf_conntrack: table full, dropping packet
    

    I would like to avoid changing my kernel on my device, just adding kernel module.

    Since I build my own image with only certain packages, the kernel doesn't have support for everything. On a clean build with the default configuration, the kernel only has CONFIG_BRIDGE=y. Support for bridge firewall is not enabled,CONFIG_BRIDGE_NETFILTER is not set.

    The kernel configuration can be change to generate net/bridge/br_netfilter.ko module for the system which has it missing. OpenWRT doesn't have a package for that kernel module. It would need to be copied manually.

    Add bridge firewalling support to iptables with iptables-mod-extra. The kmod-ipt-extra will have xt_physdev module because CONFIG_BRIDGE_NETFILTER is enabled in the kernel.

    How does default OpenWRT image has the support for bridge firewalling in their images ?

    OpenWRT enables all packages to be build which configure the kernel configuration with the required dependencies. When enabling ebtables package, the kernel configuration is overwritten with CONFIG_BRIDGE_NETFILTER=y.

    build_dir/target-mips_34kc_uClibc-0.9.33.2/linux-ar71xx_generic/linux-3.18.36/.config.old:CONFIG_BRIDGE=y
    build_dir/target-mips_34kc_uClibc-0.9.33.2/linux-ar71xx_generic/linux-3.18.36/.config.old:CONFIG_BRIDGE_NETFILTER=y
    build_dir/target-mips_34kc_uClibc-0.9.33.2/linux-ar71xx_generic/linux-3.18.36/.config:CONFIG_BRIDGE_NETFILTER=y
    build_dir/target-mips_34kc_uClibc-0.9.33.2/linux-ar71xx_generic/linux-3.18.36/.config:CONFIG_BRIDGE=y
    build_dir/target-mips_34kc_uClibc-0.9.33.2/linux-ar71xx_generic/linux-3.18.36/.config.override:CONFIG_BRIDGE=m
    build_dir/target-mips_34kc_uClibc-0.9.33.2/linux-ar71xx_generic/linux-3.18.36/.config.override:CONFIG_BRIDGE_NETFILTER=y
    build_dir/target-mips_34kc_uClibc-0.9.33.2/linux-ar71xx_generic/linux-3.18.36/.config.target:CONFIG_BRIDGE=y
    build_dir/target-mips_34kc_uClibc-0.9.33.2/linux-ar71xx_generic/linux-3.18.36/.config.target:CONFIG_BRIDGE_NETFILTER=m
    build_dir/toolchain-mips_34kc_gcc-4.8-linaro_uClibc-0.9.33.2/linux-3.18.36/.config:CONFIG_BRIDGE_NETFILTER=m
    build_dir/toolchain-mips_34kc_gcc-4.8-linaro_uClibc-0.9.33.2/linux-3.18.36/.config:CONFIG_BRIDGE=m
    

    I guess I will be need to be more careful when using opkg --force-depends option in the future. Once I have generated my image, I should use the matching SDK so I don't cause some kernel panic on the system.

  • Zotac EI751 Review

    03/18/2016 at 19:09 0 comments

    I search for NUC/Mini-PC and found some with a configuration that would suit my needs.

    Configuration :

    • Quad core
    • Multiple Display support
    • Dual Ethernet ports
    • Optical SPDIF Audio interface.
    • Multiple Sata support

    I found the GB-BXi7-4770R and the ZBOX-EI751. I decided to go for the Zotac as it has dual Ethernet port and a newer processor.

    My system is made of :

    • ZBOX-EI751
    • Crucial MX200 250GB mSATA - CT250MX200SSD3
    • Kingston Impact - 16GB - DDR3L 1866MHz - HX318LS11IBK2/16
    • WD Black 750GB - WD7500BPKX

    The Kingston Impact HX318LS11IBK2/16 works in this system. The RAM has to be DDR3L. CPU-Z reports a RAM voltage of 1.35V.

    Looking for some information about EI751 online, I found information about an onboard SATA connector in addition to the mSATA and 2.5" SATA connector. It turns out that the BIOS do list an additional SATA port but the actual SATA connector is not populated on the motherboard. They could have done us a favor by populating those connector ( SATA and COM1 ). I may populate them if i find suitable connector but I'll wait to break the warranty seal.

    I wanted to be able to use 2 digital full HD monitors. The EI751 has 3 display output ( 2 x DisplayPort and 1 DVI ). I connected my LCD to the DVI port with the provided HDMI adapter and I was surprised to have audio support.

    I was unable to use 3 display simultaneously under Windows 7. Windows screen resolution pops Unable to save display settings error. Asking Zotac about it, they say The EI751 supported three display outputs at the same time under Windows. But no further information about it. Intel Iris Pro Graphic 6200 is not listed in 3 Displays FAQ ! Need to check under Linux.

    The I7-5775R processor support a wide range of frequency steps.