Minimal IPTABLES config for SOHO routers

If the br0 is LAN port, and the eth0.101 is a WAN port (and 10.10.1.0 inside):

iptables -A INPUT -i br0 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.10.1.0/24 -i br0 -j ACCEPT
iptables -A FORWARD -d 10.10.1.0/24 -i eth0.101 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0.101 -j MASQUERADE
iptables -P INPUT DROP
iptables -P FORWARD DROP

If you want to allow SSH from the WAN port (nope, but, you did remember to set a strong password, right?), you can use the following command to open up port 22 from the WAN interface:

iptables -A INPUT -i eth0.101 -p tcp -m tcp --dport 22 -j ACCEPT

If all OK, save config:

Edit /etc/network/if-pre-up.d/iptables file:

#!/bin/sh
iptables-restore --counters < /etc/iptables/rules.v4
exit 0

Mod for run, and save tables:

chmod 755 /etc/network/if-pre-up.d/iptables
mkdir -p /etc/iptables
iptables-save > /etc/iptables/rules.v4

Moving Bananian 15 to SATA HDD/SSD

Create a mp, mount, and copy all files:

mkdir /tmp/sata
mmount /dev/sda1 /tmp/sata
rsync -arx --progress / /tmp/sata

Install boot tools:

apt-get install u-boot-tools

Mount boot:

mount /dev/mmcblk0p1 /boot

After mount, edit /tmp/boot/boot.cmd file, search root point and change to: ‘root=/dev/sda1’.

Create new scr file:

cd /tmp/boot
rm boot.scr
mkimage -C none -A arm -T script -d boot.cmd boot.scr