Commit 01f26380 authored by jan.koester's avatar jan.koester
Browse files

firewalld: packet filter, NAT and masquerading over nf_tables 

One nf_tables table (inet firewalld) replaced per change in a single
netlink transaction: filter rules for input/forward/output, masquerade,
snat and dnat for IPv4 and IPv6, forwarding sysctls, counters, and test
changes that are undone unless confirmed. Carries out syslite's
IPMasquerade=/IPForward=. sysbus service "firewalld", firewallctl.
BSD 3-Clause License.

Co-Authored-By: default avatarClaude Opus 5.5 <noreply@anthropic.com>
parents

.gitignore

0 → 100644
+1 −0
Changes for .gitignore: 1 added line, 0 removed lines.
Original line number Diff line number Diff line 
build/

CMakeLists.txt

0 → 100644
+55 −0
Changes for CMakeLists.txt: 55 added lines, 0 removed lines.
Original line number Diff line number Diff line 
cmake_minimum_required(VERSION 3.16)

project(firewalld VERSION 0.1.0 LANGUAGES CXX)



# firewalld: the packet filter of FenrirOS. It keeps one nf_tables table,

# "inet firewalld", and replaces it as a whole (one netlink transaction,

# no nft or libnftnl needed) whenever its configuration changes: filter

# rules for incoming, routed and outgoing traffic (IPv4 and IPv6 alike),

# NAT -- masquerading and source NAT out of an interface, port forwards

# (destination NAT) -- and IP forwarding (the ip_forward sysctls). Every

# rule has a counter. A change can be tried out: it is undone unless

# confirmed in time, so a wrong rule doesn't lock an administrator out.

# Its settings live in /etc/firewalld/firewalld.yaml (libconfplus);

# firewalld is controlled over sysbus as the service "firewalld"

# (include/firewalld/api.h) -- webctl's firewall page is its client.

#

#   firewalld     the daemon (root, CAP_NET_ADMIN)

#   firewallctl   command line over sysbus

#

# The kernel needs nf_tables with inet tables, ct, nat, masq, reject, log

# and limit (CONFIG_NF_TABLES_INET, CONFIG_NFT_NAT, ...); they load on

# demand.



set(CMAKE_CXX_STANDARD 17)

set(CMAKE_CXX_STANDARD_REQUIRED ON)

if(NOT CMAKE_BUILD_TYPE)

  set(CMAKE_BUILD_TYPE RelWithDebInfo)

endif()



include(GNUInstallDirs)



find_package(libconfplus REQUIRED)

find_package(sysbus REQUIRED)



set(FIREWALLD_CONFIG "/etc/firewalld/firewalld.yaml" CACHE FILEPATH "configuration file")



add_executable(firewalld

    src/main.cpp

    src/config.cpp

    src/match.cpp

    src/ruleset.cpp

    src/nftables.cpp

)

target_include_directories(firewalld PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/include ${CMAKE_CURRENT_SOURCE_DIR}/src)

target_compile_definitions(firewalld PRIVATE FIREWALLD_CONFIG="${FIREWALLD_CONFIG}")

target_link_libraries(firewalld PRIVATE confplus::confplus sysbus::sysbus)



add_executable(firewallctl src/firewallctl.cpp)

target_include_directories(firewallctl PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/include)

target_link_libraries(firewallctl PRIVATE sysbus::sysbus)



install(TARGETS firewalld firewallctl RUNTIME DESTINATION ${CMAKE_INSTALL_SBINDIR})

install(DIRECTORY include/firewalld DESTINATION ${CMAKE_INSTALL_INCLUDEDIR})

install(FILES dist/firewalld.yaml DESTINATION /etc/firewalld)

set(FIREWALLD_UNITDIR "/etc/syslite/services" CACHE PATH "syslite unit directory")

install(FILES dist/firewalld.service DESTINATION ${FIREWALLD_UNITDIR})

LICENSE

0 → 100644
+29 −0
Changes for LICENSE: 29 added lines, 0 removed lines.
Original line number Diff line number Diff line 
BSD 3-Clause License



Copyright (c) 2026, Jan Koester

All rights reserved.



Redistribution and use in source and binary forms, with or without

modification, are permitted provided that the following conditions are met:



1. Redistributions of source code must retain the above copyright notice, this

   list of conditions and the following disclaimer.



2. Redistributions in binary form must reproduce the above copyright notice,

   this list of conditions and the following disclaimer in the documentation

   and/or other materials provided with the distribution.



3. Neither the name of the copyright holder nor the names of its

   contributors may be used to endorse or promote products derived from

   this software without specific prior written permission.



THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"

AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE

FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR

SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER

CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,

OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

dist/firewalld.service

0 → 100644
+11 −0
Changes for dist/firewalld.service: 11 added lines, 0 removed lines.
Original line number Diff line number Diff line 
[Unit]

Description=firewalld: packet filter, NAT and masquerading (nf_tables)

Before=network.target



[Service]

Type=simple

ExecStart=/usr/sbin/firewalld

Restart=always



[Install]

WantedBy=multi-user.target

dist/firewalld.yaml

0 → 100644
+47 −0
Changes for dist/firewalld.yaml: 47 added lines, 0 removed lines.
Original line number Diff line number Diff line 
# firewalld: packet filter, NAT and masquerading (the nf_tables table

# "inet firewalld"). Edit with firewallctl or webctl; by hand, then:

# firewallctl reload

firewalld:

  enabled: false              # true: the rules below are in the kernel

  input: drop                 # incoming connections no rule accepts: drop|reject|accept

  forward: drop               # routed ones (between interfaces); port forwards pass

  ping: true                  # answer ICMP/ICMPv6 echo requests

  log: false                  # log what input/forward drop (kernel log, 5 a minute)

  ipv4_forwarding: false      # route IPv4 between interfaces (needed for NAT)

  ipv6_forwarding: false      # route IPv6

  # always accepted: replies, loopback, neighbor discovery and the other

  # ICMPv6 IPv6 needs, IGMP, DHCP(v6) client answers

  next_id: 3

  rules:

    - id: r1

      chain: input            # input|forward|output

      action: accept          # accept|drop|reject

      protocol: tcp           # tcp|udp|icmp|icmpv6|sctp|<number>, or a list

      ports: 22               # 22, 8000-8100, or a list

      comment: SSH

    - id: r2

      chain: input

      action: accept

      protocol: tcp

      ports: 8443

      comment: webctl

    # - id: r3

    #   chain: input

    #   action: accept

    #   protocol: [tcp]

    #   ports: [445, 2049, 3260]

    #   source: [192.168.1.0/24, "2001:db8::/32"]

    #   in: eth0              # a trailing * matches every name it starts

    #   comment: SMB, NFS, iSCSI from the LAN

  # nat:

  #   - id: n4

  #     type: masquerade      # masquerade|snat|dnat

  #     out: eth0             # leaving by the uplink ...

  #     source: [192.168.10.0/24]  # ... what comes from here (forward: true lets it through)

  #   - id: n5

  #     type: dnat            # a port forward

  #     in: eth0

  #     protocol: tcp

  #     ports: 8080

  #     to_address: 192.168.10.20

  #     to_port: 80