homemade_firewall

My own hand-made firewall learning project with nftables.

License

This program is licensed under the Affero GNU Public License v3, you can read the copy that comes along with this program or read it at gnu.org's website

Dependencies

The following is needed to setup this firewall:

• nftables
• make
• support for nftables, forwarding and conntrack in kernel

And the following to run the optional makeconf.sh script:

• bash version 4+

Because it makes use of bash arrays and integer variables introduced from that version onwards.

Usage

To use this firewall, you must first change the .nft files to suit your setup.

Once you're satisfied, run: make makeconf to generate your nftables.conf.

Run the following command before installing make test so nftables can check for errors.

If there are no errors, you can install and run with make install

You can verify that your new rules are in place with nft list ruleset

To uninstall, run make uninstall, which will replace the contents of /etc/nftables.conf with the backup made at install-time and saved in backup.conf.

Modifying .nft files

The following are guidelines for editing the .nft files to your liking

defines.nft

In defines.nft you can place your defines.

Every service under the TCP and UDP services comment should be placed in tcp and udp named sets.

Every service under the TCP only services comment should be placed in the tcp named set.

Services under the UDP only services comment should be placed in the udp named sets.

nat.nft

In nat.nft you can place your nat table, chains and rules.

You don't need to include defines.nft since it is included in filter.nft

filter.nft

In filter.nft you can place your filter table, chains and rules.

This is the main file where you'll do most of your work.

Make sure you erase the ipv4_geo_blacklist named set and rules related to it if you're not going to block country-wide IP ranges.

makeconf script

This script unifies the .nft files into a single nftables.conf file ready to be placed into /etc/nftables.conf.

It replaces includes of local .nft files with their contents into filter.nft and saves it as nftables.conf.

It also checks which countries you want to block by checking what files exist under /var/geoipsets/dbip/nftset/ipv4/*.ipv4 and places them into the ipv4_geo_blacklist named set.

Bug-reporting

Try to register an account, wait to be approved and submit an issue. If I take too long to approve your account or I reject your application, you can send me an email at celsochan@disroot.org