Thursday, June 7, 2018

HiKey 960 Linux Bridged Firewall

The Kirin 960 SoC and on-board USB 3.0 make the HiKey 960 SBC an ideal platform for running a Linux Bridged firewall.  The number of single-board computers with an SoC as powerful as the HiSilicon Kirin 960 are limited.

When compared with the Raspberry Pi series of single board computers (SBC), the HiKey 960 SBC is significantly more powerful.  The Kirin 960 also stands above the ARM powered SoCs which reside in most commercial routers.

USB 3.0 makes the HiKey 960 board an especially attractive option for bridging or routing, filtering network traffic, or connecting to an external gateway via IPSec.  Both network traffic filtering and IPSec tunneling can be computationally expensive operations.  However; the multicore Kirin 960 is well suited for these types of tasks.

In order to be able to run an IPSec client tunnel and a Linux Bridged firewall connected over 1G ethernet links, certain kernel configuration modifications are needed.  Furthermore, the Android Linux kernel for the HiKey 960 board does not boot on a standard Linux root filesystem because it is designed to boot an Android customized rootfs.

The latest googlesource Linux kernel (hikey-linaro-4.9) for Android (designed to boot Android on the HiKey 960 board) has been customized to remove the Android specific components so that the kernel boots on a standard Linux root filesystem, with the proper drivers enabled for network connectivity via attached 1000Mb/s USB 3.0 to ethernet adapters.  The standard UART interface on the board should be used for serial connectivity and shell access.  WiFi and Bluetooth have been removed from the kernel configuration.  The kernel should be booted off of a microSDHC UHS-I card.  The 96boards instructions should be followed for configuring the HiKey 960 board, setting the jumpers on the board, building and flashing the l-loader, firmware package, partition tables, UEFI loader, ARM Trusted Firmware, and optional Op-TEE.  Links for the normal Linux kernel configuration, multi-interface bridge configuration, and single interface IPSec configuration are below.  Additional kernel config modifications may be needed for certain types of applications.

HiKey 960 Linux kernel build instructions
Linux kernel source and custom kernel configuration
Multi-interface bridge configuration
Single interface IPSec configuration