# Firewall-local add-on **URL:** \ **Category:** Add-Ons\ **Created:** [12 June 2026 16:19 UTC](https://community.ipfire.org/t/firewall-local-add-on/15885 "2026-06-12T16:19:04Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![hjkl](https://community.ipfire.org/user_avatar/community.ipfire.org/hjkl/32/8574_2.png) [@hjkl](https://community.ipfire.org/u/hjkl)\ **Post date:** [12 June 2026 16:19 UTC](https://community.ipfire.org/t/firewall-local-add-on/15885/1 "2026-06-12T16:19:04Z")
# New add-on: Firewall-Local — modular firewall orchestration for IPFire **Firewall-Local** is an IPFire add-on that manages iptables/ipset rules through a small set of master-list files and a web UI, shipped as a standard `.ipfire` package. It adds five rule modules on top of IPFire’s native firewall, each with its own CGI page. The integration is achieved via `/etc/sysconfig/firewall.local`. - **Location Allow** — INBOUND country allowlist. Default posture is _drop everything_; only the countries you add can reach the box (the opposite of native IPFire, which allows all traffic except the countries you select to block). - **ASN Block** — allow or block by Autonomous System Number (ASN — the ID for a network operator’s address space). Each ASN is expanded into a kernel ipset. - **IP / CIDR Rules** — per-IP, per-subnet, or per-ipset rules with multiport and multi-chain targeting (CIDR — the `address/prefix` notation, e.g. `/24`). - **SMB Allow** — let one named WiFi (Blue) host reach a Samba/NAS box while SMB stays dropped for every other Blue client (requires the firewall option _Drop SMB_ to be on). - **Outgoing Location Block** — block outbound traffic to a long list of countries in a single ipset lookup. It loads from IPFire’s pre-built country ipset files. **Why it exists.** It’s a thin orchestration layer over what IPFire already has — ipsets, the location database, the standard chains — aimed at edge cases that are awkward to express in the stock UI: pre-VPN blocks, per-host SMB exceptions, selective Squid proxy bypass, single-destination GeoIP holes, and keeping WHOIS / cert-check / encrypted-DNS traffic reachable even under an aggressive GeoIP posture. Where a feature depends on _where_ a rule sits in the packet path, the placement is shown in the included firewall diagram — I’d rather you read it there than take my word for it. **Requires:** IPFire 2.x. ## Links - **Repository:** [Firewall-Local](https://github.com/horace-michael/firewall-local) - **Install:** download the latest `.ipfire` package from the [Releases page](https://github.com/horace-michael/firewall-local/releases). - **Usage guide** (the web UI, with screenshots): [Usage.md](https://github.com/horace-michael/firewall-local/blob/master/USAGE.md) - **Feature list** (why and when to reach for each module): [Feature List](https://github.com/horace-michael/firewall-local/blob/master/docs/FEATURE_LIST.md) Feedback, missed edge cases, and breakage reports are welcome. ---
**Author:** ![bloater99](https://community.ipfire.org/user_avatar/community.ipfire.org/bloater99/32/15796_2.png) [@bloater99](https://community.ipfire.org/u/bloater99)\ **Post date:** [12 June 2026 19:16 UTC](https://community.ipfire.org/t/firewall-local-add-on/15885/2 "2026-06-12T19:16:00Z")
Will this eventually appear in Pakfire Add-ons? ---
**Author:** ![hjkl](https://community.ipfire.org/user_avatar/community.ipfire.org/hjkl/32/8574_2.png) [@hjkl](https://community.ipfire.org/u/hjkl)\ **Post date:** [13 June 2026 15:14 UTC](https://community.ipfire.org/t/firewall-local-add-on/15885/3 "2026-06-13T15:14:47Z")
Hello Tim, > [@bloater99](#): > > Will this eventually appear in Pakfire Add-ons? I am not an IPFire developer. What I develop I do it for my edge cases - I start by writing down what I need and is not easily covered by current UI and then start to develop that. And, I do intend to add to it other edge cases - some lost in old IPFire forum like block traffic from/to a specific Company (Like block all Amazon) - this ideea was implemented and posted in old forum by Shellshock and Umegee Stay tuned. ---
**Author:** ![hjkl](https://community.ipfire.org/user_avatar/community.ipfire.org/hjkl/32/8574_2.png) [@hjkl](https://community.ipfire.org/u/hjkl)\ **Post date:** [15 June 2026 10:11 UTC](https://community.ipfire.org/t/firewall-local-add-on/15885/4 "2026-06-15T10:11:31Z")
Version [1.8.0-ui](https://github.com/horace-michael/firewall-local/releases/tag/v1.8.0-ui) was launched. 1.8.0-ui Version introduce “ **Company Block** ” feature - **Feature list** (why and when to reach for each module): [Company Block](https://github.com/horace-michael/firewall-local/blob/master/docs/FEATURE_LIST.md#12-company-block) This modules has some limitations in Keys accepted as “search for company”. Also, please be aware that one key can hit more than one Company - blocking more than it was meant to be blocked. **Use it with care.**