# Network port service control

***Copyright © Quectel Wireless Solutions Co., Ltd. 2026. All rights reserved.***

---

# Open ports

For development and remote maintenance, the following **TCP** ports are open:

| **Port** | **Protocol (typical)** | **Description** |
| --- | --- | --- |
| 22 | TCP | **SSH**: secure remote login, maintenance, debugging, and file transfer (**SCP/SFTP**). |
| 3389 | TCP | **RDP**: Windows Remote Desktop; on the board this is often **xrdp** or similar. |
| 5900 | TCP | **VNC**: graphical remote desktop access. |

# View current firewall rules

On the board, run:

```bash
iptables-save
```

This shows the full ruleset (chain policies and each **INPUT** rule). For a list view only:

```bash
iptables -L -n -v
```

Normally the **INPUT** chain default **policy** should be **DROP**, with **ACCEPT** rules for ports such as **22**, **3389**, and **5900** (confirm on your device).

Example (excerpt, for reference only):

```plaintext
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3389 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5900 -j ACCEPT
COMMIT
```

# Adding ports

Rules loaded at boot are usually stored in:

- **IPv4**: /etc/iptables/rules.v4

- **IPv6**: /etc/iptables/rules.v6

Edit as **root**, for example:

```bash
sudo vi /etc/iptables/rules.v4
sudo vi /etc/iptables/rules.v6
```

The **IPv4** *filter block is similar to the example above: allow established traffic and loopback first, then add **ACCEPT** lines per port.

## Allow a TCP port

After **-A INPUT -i lo -j ACCEPT** and before **COMMIT**, add one line (replace **PORT** with the real port, e.g. **80**, **443**):

```plaintext
-A INPUT -p tcp -m tcp --dport PORT -j ACCEPT
```

Alternative form (matches some export formats):

```plaintext
-A INPUT -p tcp --dport PORT -j ACCEPT
```

## Allow a UDP port

```plaintext
-A INPUT -p udp -m udp --dport PORT -j ACCEPT
```

## Remove a port rule

Delete the matching **-A INPUT ... --dport PORT ...** line from the rules file. Reload the service (next section) for the change to persist.

> **Note**: Do not remove **RELATED,ESTABLISHED** or **lo** (loopback) rules, or return traffic and local services may break.

# iptables-restore service

The board enables **iptables-restore.service** by default to restore rules from **rules.v4** / **rules.v6** at boot.

## Stop the service temporarily

To stop it only for the current session (e.g. troubleshooting):

```bash
sudo systemctl stop iptables-restore.service
```

This is temporary. If the unit is still **enabled**, it will run again after reboot and reload **rules.v4** / **rules.v6**.

## Disable at boot (no auto-load after reboot)

To avoid automatic rule restore after reboot:

```bash
sudo systemctl disable iptables-restore.service
```

After **disable**, the service will not start on reboot and will not apply **rules.v4** / **rules.v6** automatically.

To re-enable automatic load at boot:

```bash
sudo systemctl enable iptables-restore.service
sudo systemctl start iptables-restore.service
```

## Quick status checks

```bash
systemctl is-enabled iptables-restore.service  # enabled at boot or not
systemctl is-active iptables-restore.service   # active now or not
```

> **Note**: **disable** only affects whether the unit starts on the *next* boot; it does not by itself flush current kernel rules. Verify with **iptables -L -n**.

## Reload after editing rule files

After changing the rules files:

```bash
sudo systemctl daemon-reload
sudo systemctl restart iptables-restore.service
sudo systemctl status iptables-restore.service
```

Confirm with **iptables -L -n** or **iptables-save** that the live rules match the files.

If the service fails, use **systemctl status** and logs; check **/etc/iptables/rules.v4** syntax (each **-A** on its own line; **\*filter** … **COMMIT** paired).

# Notes

- Common remote ports: **22 (SSH)**, **3389 (RDP)**, **5900 (VNC)** — always confirm with **iptables-save** on the device.

- Persist changes in **/etc/iptables/rules.v4** (and **rules.v6** if needed) by adding or removing **--dport** lines as above.

- After edits, run **systemctl restart iptables-restore.service** and verify with **iptables -L -n**.

- **systemctl stop iptables-restore.service** is temporary; with **enabled**, rules reload from file after reboot. For lasting policy, edit the files and **restart** the service.