Transferring files via network

When transferring files with putty or ssh/scp there are two things to consider:

• Use the scp protocol, it puts less strain on the pi (putty might default to the sftp protocol)

• Use multiple copy instances (2 or three), as a single one might cap out on the CPU before it saturates the network link. Alternatives might be rsync or netcat (not encrypted) but I haven’t tried them yet (scp was fine enough).

Group for user with access to shared files

I create a group that contains all users/services which need access to shared files. This affects the main ssh user (loebl) as well as all file sharing services (transmission, http, samba). Using a common group is a rather convenient way to serve a file through different tools.

groupadd netusers
usermod -a -G netusers loebl

Basics

To start filtering packets, you first need to define a table for a specific protocoll. Relevant here are IPv4 and IPv6. They can both be addressed with the inet table family. Each table contains one or more chains, which contain one or more rules.

Packets which aren’t matched by any rule pass through unhindered. There aren’t any rules, chains or tables unless they are specified in the configuration (iptables had some pre-defined chains).

Rules can be created with the command line utility nft. They can also be written into a config file to be loaded at boot time with nft -f. Currently loaded rules can be viewed with nft list ruleset.

Simple setup

In arch the nftalbes service will read in the config file /etc/nftables.conf. Per default it contains rules to drop every incoming packet except ssh connections (which is an already usable base setup). I will recreate this here, but change the structure. First I will create the basic table used for all my purposes:

#!/usr/bin/nft -f

table inet myrules {
}

In this table I set a chain on the input hook. This way incoming packets for local processes go through the chain:

chain incoming {
  type filter hook input priority 0; policy drop;
}

Other hooks are prerouting (run before deciding if the packet gets forwarded or to a local process), forward (run on forwarded packets), output (packets emitted from local processes) and postrouting (all outgoing packets, forwarded and from processes). Priority can be set if there are multiple chains for the same hook. The smaller the number, the higher the priority. Negative numbers are supported.

The policy statement is the default action if no rule matches. The statement above basically implements a whitelist, every packet not allowed is dropped.

Now some basic rules are added in the chain:

# allow packets for existing connections
ct state {established, related} accept
ct state invalid reject

# allow packets from loopback device unhindered
iifname lo accept

# allow ICMP packets
ip protocol icmp accept
ip6 nexthdr icmpv6 accept

The first line will accept any packets belonging to an already established connection (usually TCP connections). The next one will drop packets which couldn’t be matched to a connection and send an ICMP port unreachable packet. For public servers some like to change this to drop. Next we accept any packets coming from the loopback device. Also ICMP packets are all accepted.

After these I include my per-application rules from a subdirectory, with one file per application:

include "/etc/nft_rules/in_*"
counter reject

The leading “/etc” is important to have nft look in the correct directory for included files and directories. It searches only in a directory specified at compile time (/usr/share for my distribution) or additionally in paths given with -I on the commandline. The shell wildcard is supported to include many files in one statement. Not finding an included file is not treated as an error, so care should be taken to ensure files are found (or you will end up closing the box). The last line will emit an ICMP packet for every request not served until now. The counter command will install a counter, so the number of rejected packets will be counted.

The only application rule for now are sshd and LLMNR. Create the file nft_rules/in_sshd.conf with the following content:

tcp dport 22 accept

The folder nft_rules should be a subdirectory of /etc. SSH only requires a single rule: accept TCP packets on port 22. In this case one could also write ssh instead of 22, as nftables has a list of well known ports.

Then in the same manner create the rule file in_llmnr.conf with the content:

udp dport 5355 accept
tcp dport 5355 accept