Tools KUAL Firewall with BBB filter

[knc1]

What is this thing for?

Normally, the Kindle's firewall prohibits any incoming connections.
(except some 3G control thingies)

This firewall normally also prohibits any incoming connections.
(except the same 3G control thingies)

What this KUAL firewall does is adopt an infrastructure that will allow the automation (by button tap) of adding and removing network services and adjusting the firewall rules to match.

Network services such as ssh, ftp, rsync (for syncronizing the Kindle filesystem to/from a remote computer), and about 1,000 others.

The **base** infrastructure of this firewall also includes the "Block Big Brother" output filter by default.
There is a button to remove the BBB filter if desired, leaving just the new infrastructure to support the future automation of network service addition and removal.

Installation

• Un-pack the archive
• Move or copy the bbb directory (and its sub-directories and files) as an entry under the */extensions directory in USB storage.

There will be two directories created when you un-pack the archive: bbb and: refs.
The 'refs' directory does not have to be on the Kindle - keep it wherever you keep your reference materials.

The two files under 'refs' is your license to use this firewall rule-set and the listing of registration information for the IP address ranges being blocked by the BBB filter.

Button Functions
Load firewall/BBB filter (/ == 'with')
Remove BBB filter only (leaves the new infrastructure behind)
Generate packet report (For the curious, and for inclusion with trouble reports)
Clear packet counters (guess what)
Load factory firewall (re-loads the Amazon factory firewall)

The two control buttons (Packet Report, and Clear Counters) works with either this new firewall or the Amazon firewall.

BIG RED NOTE: The new firewall does not survive a kernel re-boot, YOU must reload it after re-booting the Linux kernel.

Enjoy, feedback welcome.

Sources: http://hg.minimodding.com/repos/sys/...4ea620e/simple

[twobob]

So impressed. Am fiddling now.

EDIT: Excellent.

Only side effect I managed to find so far was applying the firewall while the USB was connected caused it to be ¨re-discovered¨ : ) Just as it should be. No That was a dodgy cable...

Reports work great. Don´t see a down-side yet ; ) All in total result.

Pressed the various buttons. all seemed in order. : D

Quality. will index. EDIT: DONE

[knc1]

Originally Posted by twobob

So impressed. Am fiddling now.

Find the "Clear Counters" **script** and my question of this morning will be answered.

[DuckieTigger]

Oh nice, it seems to work just fine - the BBB part. Not even downloading from the cloud works. This is great to be able to put the PW out of airplane mode. Maybe I will set up my USBNetwork over wifi now.

[DuckieTigger]

Originally Posted by knc1

Find the "Clear Counters" **script** and my question of this morning will be answered.

This: /usr/sbin/iptables? It got everything you need build in?

[twobob]

Originally Posted by knc1

Find the "Clear Counters" **script** and my question of this morning will be answered.

Ye gods man the scripts are a thing of beauty.

I am eyeball wandering but will index first.

[knc1]

Originally Posted by DuckieTigger

Oh nice, it seems to work just fine - the BBB part. Not even downloading from the cloud works. This is great to be able to put the PW out of airplane mode. Maybe I will set up my USBNetwork over wifi now.

That will be the first firewall hole-punching button.
To allow port 22 and fire up the ssh server with the correct options.

But you can use Wifi on your own home network, it is just the "free" public hotspots that do not (yet) work.

If you want to do it by hand:
iptables -t filter -I wlan-in -dport:22 -j ACCEPT
Or something like that, I may have the 'destination port' option typo'd - man page will show how to write it.

Without specifying a rule number to instert at, it inserts as Rule #1 - which is just the place is should go in the wlan-in chain.

Duh...
That was not an accident.
Also - notice you don't need a script - you can code that in the menu.json 'action:' field.

[twobob]

Originally Posted by knc1

That will be the first firewall hole-punching button.
To allow port 22 and fire up the ssh server with the correct options.

But you can use Wifi on your own home network, it is just the "free" public hotspots that do not (yet) work.

If you want to do it by hand:
iptables -t filter -I wlan-in -dport:22 -j ACCEPT
Or something like that, I may have the 'destination port' option typo'd - man page will show how to write it.

Without specifying a rule number to instert at, it inserts as Rule #1 - which is just the place is should go in the wlan-in chain.

Duh...
That was not an accident.
Also - notice you don't need a script - you can code that in the menu.json 'action:' field.

[knc1]

Originally Posted by twobob

Only side effect I managed to find so far was applying the firewall while the USB was connected caused it to be ¨re-discovered¨ : ) Just as it should be.

That seems strange - which device?

Kpw-5.3.3, USB network running, ssh connection established, Linux box for client.

Doing anything at all to the firewall does not affect usb net.
(It is not suppose to - the commands used cause the kernel to do the entire change in-between packets.)

Hmm...
I never tried the firewall buttons while the USB connection was in storage mode. Maybe that is what you found.

[twobob]

I just repeated the test and it didnt happen.

and LOOKING AT THIS CABLE it is shonky as crapola.

probably knocked it out during the test slightly.

and YES FOLKS that is why we repeat them

seems perfectly right now.

Lesson learned? Dont use shitty usb cable when testing. Go get the good one. !!

Excellent work. Indexed.

Thanks!!

[piperclassique]

Oh this is nice! Thank you so much!

[Analogus]

knc1

Thanks for this great modification! Working on my PW.

If there is a simple way to make WIKIPEDIA run without Amazon and BBB swithced ON - that would be perfect.

A.

[knc1]

Originally Posted by DuckieTigger

This: /usr/sbin/iptables? It got everything you need build in?

Sorry - Missed this one earlier.

The userland application (iptables) seems to be complete, if not, twobob has already built the newest and greatest.

The factory kernel on the other hand is missing a lot of the netfilter modules.
Will have to build those and ship them as part of the BBB (and later, the kWall) button set.

For instance: lab126 did not build the "REJECT" module.
Which is required for proper protocol control operation.

[baf]

Originally Posted by knc1

Sorry - Missed this one earlier.

The userland application (iptables) seems to be complete, if not, twobob has already built the newest and greatest.

The factory kernel on the other hand is missing a lot of the netfilter modules.
Will have to build those and ship them as part of the BBB (and later, the kWall) button set.

For instance: lab126 did not build the "REJECT" module.
Which is required for proper protocol control operation.

I once built netfilter kernel modules for KT 5.3.2 (attached). I had an idea to block outgoing connections by process id (-m owner --pid-owner), but it turned out that this option is not supported by modern kernels anymore.

[knc1]

Originally Posted by baf

I once built netfilter kernel modules for KT 5.3.2 (attached). I had an idea to block outgoing connections by process id (-m owner --pid-owner), but it turned out that this option is not supported by modern kernels anymore.

Thanks. Will bookmark this post.

Re-generating my Kindle source file catalog for Feb., 2013 - -
Once that is done, I will then learn from it just how many flavors of these kernel modules will have to be built to support all 7 KUAL devices.

(1,664,823 files now cataloged, but the program has only been running about 20 hours.)
(2,547,574 files now cataloged, 24 hour runtime, hope to be finished by this evening.)
(3,126,096 files now cataloged, 27 hour runtime, hope the electrons aren't wearing out.)
(4,290,077 files cataloged, about 35 errors reported, 35.5 hours wall time, 40% on 2 cores, 20% on the other 2 cores the entire time.)
Damn good for a decade old Bash script!