Skip to content

Latest commit

 

History

History
86 lines (65 loc) · 2.98 KB

README.md

File metadata and controls

86 lines (65 loc) · 2.98 KB
Raw

nftables_firewall.js

This is just a proof of concept / test to use NodeJS as a firewall.

Disclaimer

Please consider that this is only an 'initial' demonstration / proof of concept. I cannot take any responsibility of issues caused by using this.

It most definitely is NOT production ready.

I recommend you understand some basics of NFTables to otherwise reset your rules to a safe state before continuing. That way, in the event of any issue; you can quickly roll back to a 'safe' environment state.

On that note, however; I, personally; use it as my day to day firewall.

Description

This is an example managing nfQueue packed from within NodeJS.

The overall 'result' is, effectively; a Firewall written in NodeJS.

To describe the topology;

  1. Packet received by nftables, queued to nfqueue (userspace)
  2. NodeJS listens on queue for packets, and handles appropriately.

This is achieved by using lipcap, nftables, and nfqueue.

Dependencies

  • linux
  • nftables

To successfully build some of the child dependencies with yarn install, as some build directly from sources like github - you may require things like (From a Debian system)

  • build-essential
  • libpcacp-dev
  • libnetfilter-queue-dev
  • libnfnetlink-dev

Note:

Some child dependencies have not been updated in some time failing builds with later versions of NodeJS. For best results; use LTS/Carbon (8)

Getting Started

Clone this repo within git, cd, and yarn install.

Once running, you must initialize the app with sudo (Due to use of libpcap).

I personally use;

sudo `which node` src/index.js

Usage

You can customize your rules within the *.json configuration files. To ensure you take some responsibility, these are then loaded from a 'config' folder in the root directory of the project. I symlink them;

mkdir config
cd config
ln -s ../src/config/rules.json .
ln -s ../src/config/interfaces.json .
ln -s ../src/config/rules-base.nft .
ln -s ../src/config/rules-locked.nft .

Output, when running, shows some basic stats of what has been achieved;

Packets: 513 - IN: 39 (A: 0 - R: 39) - OUT: 474 (A: 264 - R: 210)

Where A: Accepted, R: Rejected (Determined; anything other than accepted)

Customisation

'Skeleton' Configuration files may be found in src/config, and should then be placed in config/ - as mentioned above'

  • interfaces.json - specify your trusted, and untrusted, interfaces.
  • rules.json - Specify what ports, in which 'trust' zones you want to allow
    • Note: Changes to this file are 'hot loaded'. Care should be taken.
  • rules-base.nft - Is the 'initial' template of rules deployed. (Creates the appropriate table, chains)
  • rules-locked.nft - Is basically what the script 'should' fall back to if there are any failures on init (SHOULD..)

Further notes:

Interfaces are detected, with appropriate rules created, upon start. This can be troublesome for non-persistent interfaces such as vpn (ppp/tun). I restart the scrupt upon these interfaces becoming available. (And this will be fixed in an upcoming release)