NPi i.MX6ULL firewall

Hi guys,

I’m trying to install a firewall, however it looks like nf_tables, ip_tables etc kernel modules are not included. I’m not familiar with working with the kernel, so it would be difficult for me to build my own kernel or whatever.

Does anyone know the easiest way to get a firewall running on this board?


nf_tables, ip_tables should include be into the linux kernel. how do you test it ?


I ran lsmod and ip_tables is not there. But maybe I’m wrong and I just don’t know how to enable it?

debian@npi:~/libmnl$ cat /etc/os-release 
PRETTY_NAME="Debian GNU/Linux 10 (buster)"
NAME="Debian GNU/Linux"
VERSION="10 (buster)"
debian@npi:~/libmnl$ uname -r
debian@npi:~/libmnl$ lsmod
Module                  Size  Used by
imx_wm8960             16384  0
snd_soc_wm8960         40960  0
snd_soc_fsl_sai        24576  0
imx_pcm_dma_v2         16384  1 snd_soc_fsl_sai
snd_soc_fsl_spdif      24576  0
snd_soc_fsl_asrc       45056  0
imx_pcm_dma            16384  1 snd_soc_fsl_spdif
snd_soc_core          147456  7 snd_soc_fsl_asrc,snd_soc_fsl_sai,imx_pcm_dma_v2,snd_soc_fsl_spdif,imx_pcm_dma,snd_soc_wm8960,imx_wm8960
snd_pcm_dmaengine      16384  3 imx_pcm_dma_v2,imx_pcm_dma,snd_soc_core
snd_pcm                98304  9 snd_soc_fsl_asrc,snd_soc_fsl_sai,snd_pcm_dmaengine,imx_pcm_dma_v2,snd_soc_fsl_spdif,imx_pcm_dma,snd_soc_core,snd_soc_wm8960,imx_wm8960
snd_timer              32768  1 snd_pcm
evbug                  16384  0
dht11                  16384  0
touch_gt9xx            61440  0
debian@npi:/lib/modules/4.19.71-imx-r1$ ls
kernel             modules.builtin      modules.dep.bin  modules.softdep
modules.alias      modules.builtin.bin  modules.devname  modules.symbols
modules.alias.bin  modules.dep          modules.order    modules.symbols.bin
debian@npi:/lib/modules/4.19.71-imx-r1$ cd kernel/
debian@npi:/lib/modules/4.19.71-imx-r1/kernel$ ls
crypto  drivers  fs  lib  sound

How about manual loading?

sudo modprobe ip_tables
lsmod  | grep ip_tables 

lsmod | grep ip_tables returns nothing

debian@npi:~$ lsmod | grep ip_tables

And modprobe ip_tables says that it doesn’t exist.

debian@npi:~$ modprobe --verbose ip_tables
modprobe: FATAL: Module ip_tables not found in directory /lib/modules/4.19.71-imx-r1

nf_tables should also be in there, since the image is based on Debian Buster.

I’ve never done it before and know very little about it, but after some searching it looks like I need to build a new kernel with these modules in place. And to do this I need the kernel source. Do you know if Seeed have released a guide for how they have built this image? They must do something kind of special, since fire-config is on the image. Looking around on it, it seems to be a modified image of BeagleBone Black Debian minimal image. But the size of the NPi image is a lot smaller, so there are definitely some things removed from it.

This surprises me, but we provide Linux-headers so that you can compile the missing modules yourself.

Ok no problem. I might come back to you on this topic when I figure out how to compile the new kernel/modules.