JetPack 7.2 Firewall Missing / UFW init Error

Robotics & Edge Computing Jetson Systems Jetson AGX Orin
1

Hey, I installed the new operating system with JetPack 7.2. I wanted to enable the firewall to restrict networking. I tried to run the jetson-firewall, but could not install the Jetson-Platform-Services. I have tried with apt but they were not found. But I read they rely on normal ufw, so I installed ufw. When running ufw enable I get kicked out of the SSH session (I allowed port 22 for SSH before enabling):

ERROR: problem running ufw-init
iptables-restore v1.8.10 (nf_tables):
line 63: RULE_APPEND failed (No such file or directory): rule in chain ufw-not-local
iptables-restore v1.8.10 (nf_tables):
line 26: RULE_APPEND failed (No such file or directory): rule in chain ufw-after-logging-input
line 27: RULE_APPEND failed (No such file or directory): rule in chain ufw-after-logging-forward
line 28: RULE_INSERT failed (No such file or directory): rule in chain ufw-logging-deny
line 29: RULE_APPEND failed (No such file or directory): rule in chain ufw-logging-deny
line 30: RULE_APPEND failed (No such file or directory): rule in chain ufw-logging-allow
line 34: RULE_APPEND failed (No such file or directory): rule in chain ufw-user-limit
ip6tables-restore v1.8.10 (nf_tables):
line 26: RULE_APPEND failed (No such file or directory): rule in chain ufw6-after-logging-input
line 27: RULE_APPEND failed (No such file or directory): rule in chain ufw6-after-logging-forward
line 28: RULE_INSERT failed (No such file or directory): rule in chain ufw6-logging-deny
line 29: RULE_APPEND failed (No such file or directory): rule in chain ufw6-logging-deny
line 30: RULE_APPEND failed (No such file or directory): rule in chain ufw6-logging-allow
line 34: RULE_APPEND failed (No such file or directory): rule in chain ufw6-user-limit

Problem running '/etc/ufw/before.rules'
Problem running '/etc/ufw/user.rules'
Problem running '/etc/ufw/user6.rules'

client_loop: send disconnect: Connection reset

When checking the device directly, ufw status is active and port 22 is allowed, but I can’t reconnect or ping. Also, systemctl status shows that ufw is inactive.

4

Hi,
Does it work on Jetpack 6.2.2 r36.5? It seems like we don’t provide this alternative for Orin. If it works on Jetpack 6, please share where you get the guidance.

5

So, the Jetson-Platform-Services have a “current release runs on JP 6.1 GA (BSP R36.4.0) or JP 6.2 (BSP R36.4.3).” according to the documentation:
Release Notes (version 2.0) — Jetson Platform Services documentation
As this is outdated for my version I tried normal ufw as described in the following forum post:
Missing firewall service - Jetson Systems / Jetson AGX Orin - NVIDIA Developer Forums
But the service crashes as described.

6

Hi,
Please use latest Jetpack 6: 6.2.2 r36.5, to run Jetson Platform Services.

7

You may want to, while at the Orin console run following to clear ufw.

sudo ufw disable
sudo ufw --force reset

Looking at a downloaded extracted nvidia-jetson-services_2.0.0_arm64.deb, the following mirrors on Jetpack 7.2 the configuration found in /opt/nvidia/jetson-2.0.0/services/firewall/bin/jetson-firewall.sh.

sudo bash <<'EOF'
set -e

IPT=iptables

# Flush the existing IPv4 rules and user-defined chains.
$IPT -F
$IPT -X
$IPT -t nat -F
$IPT -t nat -X
$IPT -t mangle -F
$IPT -t mangle -X
$IPT -t raw -F
$IPT -t raw -X

# Temporarily allow traffic while constructing the ruleset.
$IPT -P INPUT ACCEPT
$IPT -P FORWARD ACCEPT
$IPT -P OUTPUT ACCEPT

# Always allow loopback traffic.
$IPT -A INPUT  -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT

# Allow replies to connections initiated by this computer.
$IPT -A INPUT \
    -m conntrack --ctstate ESTABLISHED,RELATED \
    -j ACCEPT

# Allow replies from this computer to permitted incoming connections.
$IPT -A OUTPUT \
    -m conntrack --ctstate ESTABLISHED,RELATED \
    -j ACCEPT

# Drop malformed/invalid connection state.
$IPT -A INPUT \
    -m conntrack --ctstate INVALID \
    -j DROP

$IPT -A OUTPUT \
    -m conntrack --ctstate INVALID \
    -j DROP

# Incoming SSH.
$IPT -A INPUT -p tcp --dport 22 \
    -m conntrack --ctstate NEW \
    -j ACCEPT

# Incoming DNS: UDP for normal queries and TCP for large responses/transfers.
$IPT -A INPUT -p udp --dport 53 \
    -m conntrack --ctstate NEW \
    -j ACCEPT

$IPT -A INPUT -p tcp --dport 53 \
    -m conntrack --ctstate NEW \
    -j ACCEPT

# Incoming HTTP and HTTPS.
$IPT -A INPUT -p tcp --dport 80 \
    -m conntrack --ctstate NEW \
    -j ACCEPT

$IPT -A INPUT -p tcp --dport 443 \
    -m conntrack --ctstate NEW \
    -j ACCEPT

# Incoming Redis.
$IPT -A INPUT -p tcp --dport 6379 \
    -m conntrack --ctstate NEW \
    -j ACCEPT

# Outgoing TCP port 30099.
$IPT -A OUTPUT -p tcp --dport 30099 \
    -m conntrack --ctstate NEW \
    -j ACCEPT

# If you really, really want to lock down your Orin uncomment next 3 lines.
# $IPT -P INPUT DROP
# $IPT -P FORWARD DROP
# $IPT -P OUTPUT DROP
EOF