Access Control Module Documentation

Module Overview (Technical)
Module Overview (Commercial/Business)
Module Overview (End User/Administrator)
Configuration Sections
Settings Reference
Common Scenarios & Examples
Limitations & Important Notes
Troubleshooting Tips
Glossary

---

1. Module Overview (Technical)

What Is Access Control?

Access Control is an IP filtering module that manages whitelist and blacklist entries for network access. It integrates with nftables firewall and Fail2Ban for automatic ban synchronization and rule application.

Architecture

Plaintext

┌─────────────────────────────────────────────────────────────────┐
│              Access Control Architecture                       │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Access Control Lists                                           │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │                                                          │   │
│  │  Whitelist                    Blacklist                  │   │
│  │  ┌────────────────┐           ┌────────────────┐         │   │
│  │  │ Office Network │           │ SIP Scanner    │         │   │
│  │  │ 192.168.1.0/24 │           │ 45.134.x.x     │         │   │
│  │  │ Priority: 10   │           │ Priority: 100  │         │   │
│  │  │ Source: Manual │           │ Source: Fail2Ban│        │   │
│  │  ├────────────────┤           ├────────────────┤         │   │
│  │  │ Admin VPN      │           │ Brute Force    │         │   │
│  │  │ 10.0.0.0/8     │           │ 185.x.x.x      │         │   │
│  │  │ Priority: 20   │           │ Source: Manual │         │   │
│  │  └────────────────┘           └────────────────┘         │   │
│  │                                                          │   │
│  └──────────────────────────────────────────────────────────┘   │
│       │                                                         │
│       ▼ Sync & Apply                                           │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │                                                          │   │
│  │  [Sync Fail2Ban]     [Apply Rules]     [Unban IP]       │   │
│  │       │                   │                │             │   │
│  │       ▼                   ▼                ▼             │   │
│  │  Import auto-bans    Apply to nftables  Remove ban      │   │
│  │                                                          │   │
│  └──────────────────────────────────────────────────────────┘   │
│       │                                                         │
│       ▼ Applied to system                                      │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │        Linux Firewall                                    │   │
│  │                                                          │   │
│  │  nftables:                                              │   │
│  │  ├─ Whitelist → Accept rules                            │   │
│  │  └─ Blacklist → Drop rules                              │   │
│  │                                                          │   │
│  │  Fail2Ban:                                              │   │
│  │  └─ Active jails with banned IPs                        │   │
│  │                                                          │   │
│  └──────────────────────────────────────────────────────────┘   │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Key Tables

Table	Purpose
`public.access_control`	Whitelist/blacklist entries

Key Files

File	Description
`modules/accessControl/`	Frontend module
`/etc/nftables.conf`	Applied rules

---

2. Module Overview (Commercial/Business)

Business Value

Access Control provides granular IP filtering:

Without Access Control	With Access Control
No IP filtering	Whitelist/blacklist
Manual firewall edits	Web interface
No Fail2Ban visibility	Sync banned IPs
Complex nftables	Simple management

Use Cases

Office Access

- Whitelist office IPs

- Allow VPN ranges

Block Attackers

- Manual blacklist

- Import Fail2Ban bans

SIP Protection

- Block SIP scanners

- Allow trunk IPs

Regional Blocking

- Block country ranges

- Allow specific networks

Feature Highlights

Feature	Benefit
Whitelist	Guaranteed access
Blacklist	Block bad actors
Fail2Ban Sync	Import auto-bans
Priority	Ordered evaluation
Protocol Filter	Specific protocols
Unban	Quick unblock

---

3. Module Overview (End User/Administrator)

What Can You Do?

Add whitelist entries
Add blacklist entries
Sync Fail2Ban banned IPs
Unban specific IPs
Apply rules to firewall
Set priority order
Filter by protocol/port

Access Control Interface

Plaintext

┌─────────────────────────────────────────────────────────────────┐
│              Access Control                                     │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Manage IP address whitelist and blacklist                     │
│                                                                 │
│  [+ Add Entry]  [Apply Rules]  [Sync Fail2Ban]                 │
│                                                                 │
│  [Whitelist] [Blacklist]                                        │
│                                                                 │
│  [🔍 Search by name, IP address, or description...]            │
│                                                                 │
│  ┌───────────────────────────────────────────────────────────┐  │
│  │ Name          │ List    │ IP Address   │ Protocol│ Source│  │
│  ├───────────────┼─────────┼──────────────┼─────────┼───────┤  │
│  │ Office LAN    │Whitelist│192.168.1.0/24│ All     │Manual │  │
│  │ Admin VPN     │Whitelist│10.0.0.0/8    │ All     │Manual │  │
│  │ SIP Scanner 1 │Blacklist│45.134.88.12  │ UDP     │Fail2Ban│ │
│  │ Brute Force   │Blacklist│185.220.101.5 │ All     │Manual │  │
│  │ SIP Scanner 2 │Blacklist│193.32.162.8  │ UDP     │Fail2Ban│ │
│  └───────────────────────────────────────────────────────────┘  │
│                                                                 │
│  Source: Manual = Added by admin, Fail2Ban = Auto-detected     │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Add/Edit Entry

Plaintext

┌─────────────────────────────────────────────────────────────────┐
│              Add Access Control Entry                           │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Name: [Office Network                   ]                     │
│    A descriptive name for this access control entry            │
│                                                                 │
│  Description: [Main office IP range      ]                     │
│    Optional description for this entry                          │
│                                                                 │
│  List Type: [Whitelist ▼]                                      │
│    Whitelist allows traffic, Blacklist blocks traffic          │
│                                                                 │
│  IP Address: [192.168.1.0/24             ]                     │
│    IP address or CIDR network                                   │
│                                                                 │
│  ──────────────────────────────────────────────────────────────│
│                                                                 │
│  Protocol: [All ▼]                                             │
│    All | TCP | UDP | ICMP                                       │
│                                                                 │
│  Direction: [Input (Incoming) ▼]                               │
│    Input | Output | Forward                                     │
│                                                                 │
│  Priority: [10            ]                                    │
│    Lower numbers = higher priority, executed first              │
│                                                                 │
│  ──────────────────────────────────────────────────────────────│
│                                                                 │
│  Source Port: [                          ]                     │
│    Optional source port or range                                │
│                                                                 │
│  Destination Port: [                     ]                     │
│    Optional destination port or range                           │
│                                                                 │
│  Interface: [eth0                        ]                     │
│    Optional network interface name                              │
│                                                                 │
│  ──────────────────────────────────────────────────────────────│
│                                                                 │
│  Enabled: ✓                                                    │
│                                                                 │
│  [Save] [Cancel]                                                │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Quick Tips

TIP

Whitelist First: Add trusted IPs before blocking ranges.

TIP

Sync Fail2Ban: Import auto-detected attackers.

WARNING

Apply Rules: Changes don't take effect until applied!

---

4. Configuration Sections

Entry Fields

Field	Description
Name	Entry identifier
Description	Optional notes
List Type	Whitelist or Blacklist
IP Address	IP or CIDR range
Protocol	All, TCP, UDP, ICMP
Direction	Input, Output, Forward
Priority	Order (lower = first)
Source Port	Optional port/range
Destination Port	Optional port/range
Interface	Optional interface
Enabled	Active/Inactive

Entry Sources

Source	Description
Manual	Added by administrator
Fail2Ban	Synced from Fail2Ban
NFTables	Synced from nftables

---

5. Settings Reference

List Types

Type	Action	Use Case
Whitelist	Allow traffic	Trusted IPs
Blacklist	Block traffic	Bad actors

Common Protocols

Protocol	Description
All	All protocols
TCP	Web, SSH, SIP-TCP
UDP	SIP, RTP, DNS
ICMP	Ping

Priority Guidelines

Priority	Use
1-50	Critical whitelist (admin access)
51-100	Standard whitelist (office, VPN)
101-200	Standard blacklist
201-500	Broad blocks (countries, ranges)

Common CIDR Ranges

CIDR	IPs	Example Use
/32	1 IP	Single attacker
/24	256 IPs	Office network
/16	65,536 IPs	Large network
/8	16M IPs	VPN range

---

6. Common Scenarios & Examples

Scenario 2: Block Attacker IP

Add Entry
Name = "SIP Scanner"
List Type = Blacklist
IP = 45.134.88.12
Protocol = UDP
Destination Port = 5060
Priority = 100
Save
Apply Rules

Scenario 3: Sync Fail2Ban Bans

Click "Sync Fail2Ban"
Wait for sync
Review new blacklist entries
Source will show "Fail2Ban"
Apply Rules if needed

Scenario 4: Unban False Positive

Find banned IP in list
Click Unban button
Confirm unban
IP is removed from blacklist
Apply Rules

---

7. Limitations & Important Notes

Technical Notes

NOTE

Apply Required: Changes need "Apply Rules" to take effect.

NOTE

Priority: Lower numbers are processed first.

WARNING

Don't Block Yourself: Always whitelist admin IPs first!

Best Practices

Whitelist Admin: Always whitelist your IP first
Specific First: Specific IPs before broad ranges
Use CIDR: Block ranges, not individual IPs
Sync Regularly: Keep Fail2Ban entries updated
Review Bans: Check for false positives

Whitelist vs. Firewall Rules

Access Control	Firewall Rules
IP-based only	Service-based
Simple allow/block	Complex rules
Quick entry	Full configuration
Fail2Ban sync	Manual only

---

8. Troubleshooting Tips

Common Issues

Symptom	Possible Cause	Solution
IP still blocked	Apply not clicked	Apply Rules
Can't access	Blacklisted	Check entries
False positive	Fail2Ban strict	Unban IP
Not blocking	Entry disabled	Enable entry

Check Entries

Sql

SELECT 
  name,
  list_type,
  ip_address,
  protocol,
  priority,
  source,
  is_enabled
FROM public.access_control
ORDER BY list_type, priority;

Fail2Ban Commands

Bash

# Check banned IPs
fail2ban-client status sshd

# Unban specific IP
fail2ban-client set sshd unbanip 192.168.1.100

# View all jails
fail2ban-client status

nftables Commands

Bash

# List current rules
nft list ruleset

# Check specific chain
nft list chain inet filter input

---

9. Glossary

Term	Definition
Whitelist	Allowed IP list
Blacklist	Blocked IP list
CIDR	IP range notation
Fail2Ban	Intrusion detection
nftables	Linux firewall
Priority	Rule order

---

Lua Script Status ℹ️

Security Module

Component	Status
Access Control	ℹ️ IP filtering - no Lua handler required

Access Control is a security configuration module. It manages IP whitelist/blacklist entries. No Lua handlers are used - rules are applied to nftables by the backend service.

---

Documentation last updated: January 2026

Access Control Module Documentation

Table of Contents

1. Module Overview (Technical)

What Is Access Control?

Architecture

Key Tables

Key Files

2. Module Overview (Commercial/Business)

Business Value

Use Cases

Feature Highlights

3. Module Overview (End User/Administrator)

What Can You Do?

Access Control Interface

Add/Edit Entry

Quick Tips

4. Configuration Sections

Entry Fields

Entry Sources

5. Settings Reference

List Types

Common Protocols

Priority Guidelines

Common CIDR Ranges

6. Common Scenarios & Examples

Scenario 1: Whitelist Office Network

Scenario 2: Block Attacker IP

Scenario 3: Sync Fail2Ban Bans

Scenario 4: Unban False Positive

7. Limitations & Important Notes

Technical Notes

Best Practices

Whitelist vs. Firewall Rules

8. Troubleshooting Tips

Common Issues

Check Entries

Fail2Ban Commands

nftables Commands

9. Glossary

Lua Script Status ℹ️

Security Module