Firewall-local add-on

Add-Ons
1

New add-on: Firewall-Local — modular firewall orchestration for IPFire

Firewall-Local is an IPFire add-on that manages iptables/ipset rules through a small set of master-list files and a web UI, shipped as a standard .ipfire package. It adds five rule modules on top of IPFire’s native firewall, each with its own CGI page.

The integration is achieved via /etc/sysconfig/firewall.local.

  • Location Allow — INBOUND country allowlist. Default posture is drop everything; only the countries you add can reach the box (the opposite of native IPFire, which allows all traffic except the countries you select to block).

  • ASN Block — allow or block by Autonomous System Number (ASN — the ID for a network operator’s address space). Each ASN is expanded into a kernel ipset.

  • IP / CIDR Rules — per-IP, per-subnet, or per-ipset rules with multiport and multi-chain targeting (CIDR — the address/prefix notation, e.g. /24).

  • SMB Allow — let one named WiFi (Blue) host reach a Samba/NAS box while SMB stays dropped for every other Blue client (requires the firewall option Drop SMB to be on).

  • Outgoing Location Block — block outbound traffic to a long list of countries in a single ipset lookup. It loads from IPFire’s pre-built country ipset files.

Why it exists. It’s a thin orchestration layer over what IPFire already has — ipsets, the location database, the standard chains — aimed at edge cases that are awkward to express in the stock UI: pre-VPN blocks, per-host SMB exceptions, selective Squid proxy bypass, single-destination GeoIP holes, and keeping WHOIS / cert-check / encrypted-DNS traffic reachable even under an aggressive GeoIP posture. Where a feature depends on where a rule sits in the packet path, the placement is shown in the included firewall diagram — I’d rather you read it there than take my word for it.

Requires: IPFire 2.x.

Links

Feedback, missed edge cases, and breakage reports are welcome.

2

Will this eventually appear in Pakfire Add-ons?

3

Hello Tim,

I am not an IPFire developer.

What I develop I do it for my edge cases - I start by writing down what I need and is not easily covered by current UI and then start to develop that.

And, I do intend to add to it other edge cases - some lost in old IPFire forum like block traffic from/to a specific Company (Like block all Amazon) - this ideea was implemented and posted in old forum by Shellshock and Umegee

Stay tuned.

4

Version 1.8.0-ui was launched.
1.8.0-ui Version introduce “Company Block” feature

  • Feature list (why and when to reach for each module): Company Block

This modules has some limitations in Keys accepted as “search for company”.
Also, please be aware that one key can hit more than one Company - blocking more than it was meant to be blocked.

Use it with care.