The Kirin 960 SoC and on-board USB 3.0 make the HiKey 960 SBC an ideal platform for running a Linux Bridged firewall. The number of single-board computers with an SoC as powerful as the HiSilicon Kirin 960 are limited.
When compared with the Raspberry Pi series of single board computers (SBC), the HiKey 960 SBC is significantly more powerful. The Kirin 960 also stands above the ARM powered SoCs which reside in most commercial routers.
USB 3.0 makes the HiKey 960 board an attractive option for bridging or routing, filtering network traffic, or connecting to an external gateway via IPSec. Both network traffic filtering and IPSec tunneling can be computationally expensive operations. However; the multicore Kirin 960 is well suited for these types of tasks.
In order to be able to run an IPSec client tunnel and a Linux Bridged firewall connected over 1G ethernet links, certain kernel configuration modifications are needed. Furthermore, the Android Linux kernel for the HiKey 960 board does not boot on a standard Linux root filesystem because it is designed to boot an Android customized rootfs.
The latest googlesource Linux kernel (hikey-linaro-4.9) for Android (designed to boot Android on the HiKey 960 board) has been customized to remove the Android specific components so that the kernel boots on a standard Linux root filesystem, with the proper drivers enabled for network connectivity via attached 1000Mb/s USB 3.0 to ethernet adapters. The standard UART interface on the board should be used for serial connectivity and shell access. WiFi and Bluetooth have been removed from the kernel configuration. The kernel should be booted off of a microSDHC UHS-I card. The 96boards instructions should be followed for configuring the HiKey 960 board, setting the jumpers on the board, building and flashing the l-loader, firmware package, partition tables, UEFI loader, ARM Trusted Firmware, and optional Op-TEE. Links for the normal Linux kernel configuration, multi-interface bridge configuration, and single interface IPSec configuration are below. Additional kernel config modifications may be needed for certain types of applications.
kernel build instructions
mkdir /usr/local/toolchains cd /usr/local/toolchains/ wget https://releases.linaro.org/components/toolchain/binaries/latest/aarch64-linux-gnu/gcc-linaro-7.2.1-2017.11-x86_64_aarch64-linux-gnu.tar.xz tar -xJf gcc-linaro-7.2.1-2017.11-x86_64_aarch64-linux-gnu.tar.xz export ARCH=arm64 export CROSS_COMPILE=/usr/local/toolchains/gcc-linaro-7.2.1-2017.11-x86_64_aarch64-linux-gnu/bin/aarch64-linux-gnu- export PATH=/usr/local/toolchains/gcc-linaro-7.2.1-2017.11-x86_64_aarch64-linux-gnu/gcc-aarch64-linux-gnu/bin:$PATH cd /usr/local/src git clone https://android.googlesource.com/kernel/hikey-linaro
cd hikey-linaro git checkout -b android-hikey-linaro-4.9
make hikey960_defconfig make -j8
multi-interface bridge configuration
Bridged configuration, no ip addresses on dual nic interfaces. (crossover cable is useful for testing). Bridge interface obtains dhcp address(/11) from wlan router. aliased interface added to br0 and assigned private subnet ip on different subnet (/8). Spanning tree set on bridge interface. Basic ebtables and iptables ruleset below.
brctl addbr <br> brctl addif <br> <eth1> <eth2> ifconfig <br> up ifconfig <eth1> up ifconfig <eth2> up brctl stp <br> yes dhclient <br> ifconfig <br>:0 <a.b.c.d/sn> up iptables --table nat --append POSTROUTING --out-interface <br> -j MASQUERADE iptables -P INPUT DROP iptables --append FORWARD --in-interface <br>:0 -j ACCEPT ebtables -P FORWARD DROP ebtables -P INPUT DROP ebtables -P OUTPUT DROP ebtables -t filter -A FORWARD -p IPv4 -j ACCEPT ebtables -t filter -A INPUT -p IPv4 -j ACCEPT ebtables -t filter -A OUTPUT -p IPv4 -j ACCEPT ebtables -t filter -A INPUT -p ARP -j ACCEPT ebtables -t filter -A OUTPUT -p ARP -j ACCEPT ebtables -t filter -A FORWARD -p ARP -j REJECT ebtables -t filter -A FORWARD -p IPv6 -j DROP ebtables -t filter -A FORWARD -d Multicast -j DROP ebtables -t filter -A FORWARD -p X25 -j DROP ebtables -t filter -A FORWARD -p FR_ARP -j DROP ebtables -t filter -A FORWARD -p BPQ -j DROP ebtables -t filter -A FORWARD -p DEC -j DROP ebtables -t filter -A FORWARD -p DNA_DL -j DROP ebtables -t filter -A FORWARD -p DNA_RC -j DROP ebtables -t filter -A FORWARD -p LAT -j DROP ebtables -t filter -A FORWARD -p DIAG -j DROP ebtables -t filter -A FORWARD -p CUST -j DROP ebtables -t filter -A FORWARD -p SCA -j DROP ebtables -t filter -A FORWARD -p TEB -j DROP ebtables -t filter -A FORWARD -p RAW_FR -j DROP ebtables -t filter -A FORWARD -p AARP -j DROP ebtables -t filter -A FORWARD -p ATALK -j DROP ebtables -t filter -A FORWARD -p 802_1Q -j DROP ebtables -t filter -A FORWARD -p IPX -j DROP ebtables -t filter -A FORWARD -p NetBEUI -j DROP ebtables -t filter -A FORWARD -p PPP -j DROP ebtables -t filter -A FORWARD -p ATMMPOA -j DROP ebtables -t filter -A FORWARD -p PPP_DISC -j DROP ebtables -t filter -A FORWARD -p PPP_SES -j DROP ebtables -t filter -A FORWARD -p ATMFATE -j DROP ebtables -t filter -A FORWARD -p LOOP -j DROP ebtables -t filter -A FORWARD --log-level info --log-ip --log-prefix FFWLOG ebtables -t filter -A OUTPUT --log-level info --log-ip --log-arp --log-prefix OFWLOG -j DROP ebtables -t filter -A INPUT --log-level info --log-ip --log-prefix IFWLOG
single-interface ipsec gateway configuration
iptables -t nat -A POSTROUTING -s <clientip>/32 -o <eth> -j SNAT --to-source <virtualip> iptables -t nat -A POSTROUTING -s <clientip>/32 -o <eth> -m policy --dir out --pol ipsec -j ACCEPT