How can I disable raspbmc's firewall for SSH access?

Question

I want to be able to SSH into my Raspberry Pi from an external IP address. Right now, this doesn't work, due to raspbmc's firewall. How can I disable this firewall?

Answer 1

Right at the top of the raspmc homepage it says:

The firewall that we added in the release can now be enabled and disabled via Raspbmc Settings.

They claim elsewhere the firewall is iptables and the system is debian based, so if you can't find Settings or it doesn't work, look thru the list returned by service --status-all for "iptables". If it's there, to stop it:

service iptables stop

If you want to disable it permanently, use:

update-rc.d iptables disable

However

You don't have to completely disable it. You need to find where the rules are and change them. There could be a file in /etc called, eg, "iptables.rules". Optionally, you can create a file from the current loaded rules with:

iptables-save > iptables-rules.txt

Now edit that file and add near the top, but after the first few lines that begin with :INPUT, :FORWARD, :OUTPUT:

-A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT

Then iptables-restore < iptables-rules.txt. This will open the sshd port. Of course, if the firewall was really blocking it, presumably raspmc is not running the sshd server by default either, so:

service ssh start

To automatically start at boot:

update-rc.d ssh enable

If you could not find the rules file that iptables is using, then you'll have to add that iptables-restore command using your file to the end of /etc/rc.local.

If you want to make the aforementioned firewall rule a little stronger, include a subnet mask limiting the source ips to your (W)LAN such as:

-A INPUT -s 192.168.0.0/24 -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT

Answer 2

Goldilocks solution did not work for me.

But here is my solution :

I added this line to the end of the /etc/network/if-up.d/secure-rmc :

sudo /sbin/iptables --flush

Answer 3

At the end of the file /etc/network/if-up.d/secure-rmc, replace the following two lines:

iptables -A INPUT -s $NETMASK -i $IFACE -j ACCEPT
iptables -A INPUT -i $IFACE -j DROP

with:

iptables -A INPUT -i $IFACE -j ACCEPT

This is where the rules come from. You can modify them to suit your needs if you desire instead of disabling the firewall completely.

Answer 4

The firewall in linux is implemented via iptables.

You can view your current set of rules with the command:

iptables -L -n

You can add rules or drop rules, however, when you reboot, the iptables rules are always reset.

That's why there is a file, that raspbmc executes at every boot:

/etc/network/if-up.d/secure-rmc

Edit it with nano:

sudo nano /etc/network/if-up.d/secure-rmc

At the very end of the file you could indeed remove the drop line, or if you want to open up certain ports, you could also do that by adding lines.

This for example is my file, it has a few ports open:

if [ "$IFACE" != "lo" ]; then
    NETMASK=$(get_subnet $IFACE)
    if [ ${#NETMASK} -eq 0 ]; then
        logger -t secure-rmc "netmask not found"
        exit 1
    fi
    iptables -A INPUT -s $NETMASK -i $IFACE -j ACCEPT
    iptables -A INPUT -p tcp --dport 5050 -j ACCEPT
    iptables -A INPUT -p tcp --dport 9091 -j ACCEPT
    iptables -A INPUT -p tcp --dport 8888 -j ACCEPT
    iptables -A INPUT -i $IFACE -j DROP
fi

If you just want to have no blocking rules, remove the last drop line and remove the $netmask from the first accept line.

You should have this:

if [ "$IFACE" != "lo" ]; then
    NETMASK=$(get_subnet $IFACE)
    if [ ${#NETMASK} -eq 0 ]; then
        logger -t secure-rmc "netmask not found"
        exit 1
    fi
    iptables -A INPUT -i $IFACE -j ACCEPT
fi