Meta tags:

Headings (most frequently used words):

nftfw, an, nftables, firewall, builder, for, debian, what, on, this, site, installation, from, package, installing, geolocation, getting, cidr, lists, using, fail2ban, updating, user, guide, how, do, manual, pages, contact,

Text of the page (most frequently used words):
the (71), and (27), for (21), nftfw (20), firewall (15), files (14), system (13), file (11), from (10), #package (10), blacklist (10), #nftables (10), how (9), with (9), using (8), use (8), are (8), fail2ban (7), installation (7), rules (7), address (7), access (7), can (7), guide (6), debian (6), user (5), lists (5), that (5), add (5), ports (5), template (5), addresses (5), block (5), directories (5), pages (4), more (4), full (4), cidr (4), geolocation (4), this (4), sympl (4), set (4), supplied (4), configuration (4), easy (4), whitelist (4), sets (4), specific (4), directory (4), python (4), all (3), updating (3), country (3), getting (3), installing (3), database (3), entries (3), action (3), outgoing (3), incoming (3), used (3), just (3), scanner (3), these (3), contain (3), rule (3), symbiosis (3), contact (2), manual (2), task (2), first (2), section (2), controlled (2), update (2), your (2), install (2), based (2), but (2), nftfwls (2), mail (2), github (2), comes (2), configured (2), some (2), pattern (2), keeping (2), allows (2), admin (2), provides (2), current (2), blocked (2), two (2), output (2), data (2), sample (2), small (2), scripts (2), create (2), again (2), local (2), should (2), editable (2), uses (2), gateway (2), machine (2), version (2), until (2), needed (2), then (2), users (2), automatically (2), automatic (2), scan (2), log (2), active (2), ranges (2), unwanted (2), blacklisting (2), see (2), contains (2), regular (2), expressions (2), creates (2), any (2), matched (2), blocking (2), removing (2), allowing (2), binary (2), zip (2), page (2), needs (2), model (2), you (2), builder (2), man (2), copyright, 2020, 2026, peter, collinson, rights, reserved, form, directed, explains, copy, interface, get, blacknets, adding, detection, which, optional, desirable, buster, later, what, site, improve, security, visit, fully, working, now, bad, guys, out, initial, editor, admins, delete, editing, tool, listing, status, each, live, entry, shows, optionally, origin, date, time, last, difference, between, times, html, generated, seen, web, php, webpage, provided, monitoring, shell, called, defined, environment, variables, generate, idea, tailoring, possible, echo, commands, framework, every, build, includes, pull, its, own, changes, perhaps, support, internal, lan, interfaces, configurable, tries, not, perform, reload, change, only, those, reloaded, looks, logins, whitelists, their, wtmp, whitelisting, told, looking, updates, when, returns, stops, being, syslog, feedback, may, countries, organisations, range, instructions, integration, detect, relevant, matching, contained, text, edit, method, testing, them, controls, number, lines, long, wait, before, patterns, five, control, placing, names, supply, connections, usually, empty, make, modifying, changing, simply, matter, making, one, contents, described, detail, while, gives, oriented, decription, quick, installed, there, containing, most, recent, click, readme, download, safety, reasons, after, document, nftfw_current, doesn, need, stand, alone, will, run, work, other, linux, distributions, written, least, release, has, been, tested, currently, running, builds, firewalls, simple, management, was, created, part, bytemark, hosting, also, fork, structure, maps, onto, sections, iptables, contacts, cookies, privacy, pdfs, config, nftfwan, nftnetchk, nftfwedit, nftfwadm, index, home,

Text of the page (random words):
nftfw an nftables firewall builder for debian nftfw home installation package installation geolocation getting cidr lists using fail2ban updating nftfw github page update sympl mail system user s guide how do i man pages man pages index nftfw 1 nftfwadm 1 nftfwedit 1 nftfwls 1 nftnetchk 1 nftfwan 1 nftfw config 1 nftfw files 1 pdfs package install geolocation getting cidr lists using fail2ban updating nftfw cookies privacy contacts nftfw an nftables firewall builder for debian the nftfw package builds firewalls for nftables the system creates a simple and easy to use configuration model for firewall management the model was created for the iptables based firewall package supplied as part of bytemark s symbiosis hosting package and also for sympl a fork of symbiosis the firewall is controlled using files in a directory structure that maps onto the sections of the active firewall to add a rule you just add a file to block an ip address with a specific set of ports you just add a file nftfw doesn t need sympl or symbiosis it s stand alone and will run on any current debian system it should work on other linux distributions the package is written in python and needs at least python 3 9 this release has been tested using python 3 11 it s currently running on python 3 13 nftfw can be installed from a debian binary package there is a zip file in the package directory containing the most recent version in nftfw_current zip click on the entries on the readme section of this page to automatically download the binary files for safety reasons nftfw needs some configuration after installation see the installation document installing nftfw from debian package easy to use firewall admin five directories control the firewall placing files in the directories create firewall rules configured from the file names the incoming d and outgoing d directories supply rules allowing access to ports for incoming and outgoing connections these files are usually empty but can contain ip addresses to make the rule more specific two more directories blacklist d and whitelist d contain ip addresses blocking or allowing access for specific addresses these files can contain ports again modifying the action of the rule changing the firewall is simply a matter of making or removing a file in one of these directories the directory contents are described in detail in the user s guide while the how do i or quick users guide gives a more task oriented decription automatic blacklisting the system contains a log file scanner that uses regular expressions to detect unwanted access and then creates files in the blacklist d directory to block access to any matched ip address files to scan the relevant ports to block for the file and the regular expressions for matching are all contained in a set of files in patterns d pattern files are small text files easy to add and edit and the system contains a method of testing them the nftfw configuration file controls the number of matched lines needed for blocking and how long to wait before removing the ip address from the blacklist integration with fail2ban the system comes with action files and installation instructions for fail2ban see using fail2ban with nftfw blacklisting by address range the system may be supplied with lists of ip address ranges used to block all the addresses in the ranges this can be used to block access to specific countries or unwanted access from organisations firewall feedback the blacklist scanner can be told how to scan the syslog file looking for log entries from nftables and updates the blacklist database when a blocked ip address returns keeping it in the firewall until it stops being active automatic whitelisting the whitelist scanner looks in the system s wtmp file for logins from users and automatically whitelists their ip addresses full use of nftables sets blacklist and whitelist rules use nftables sets and nftfw tries not to perform a full firewall reload until it s needed if just the blacklist or whitelist sets change then only those sets are reloaded configurable nftables template a user editable template provides the framework for nftables nftfw uses the template on every firewall build using includes to pull in its own rules the use of a template allows for local changes perhaps to support internal lan interfaces on a gateway machine a sample version of the template file used on my gateway machine is supplied editable nftables commands rules in incoming d and outgoing d use small action files that are shell scripts to create data for nftables rules the scripts are called with a defined set of environment variables and generate output using echo again the idea is that local tailoring should be possible and easy blacklist monitoring the system provides a tool listing the current blacklist status for each live entry it shows the ip address and optionally the country of origin the blocked ports the date and time of the first and last access and the difference between the two times html output can be generated so the data can be seen from the web a sample php webpage is provided admin editing a database editor allows admins to add and delete entries from the blacklist database initial configuration the system comes with a fully configured set of firewall rules and is supplied with some working pattern files that are in use now keeping the bad guys out visit nftfw on github improve your sympl mail system s security what s on this site installation from package full installation of the system for debian buster and later installing geolocation installing geolocation adding country detection to nftfwls which is optional but desirable getting cidr lists how to get country based cidr lists for use with blacknets d using fail2ban how to install the fail2ban interface updating nftfw how to update your copy of nftfw user s guide the full user guide the first section explains how the system is controlled how do i a more task directed guide manual pages manual pages contact a contact form copyright 2020 2026 peter collinson all rights reserved