Firewall Settings Module Documentation
Table of Contents
- Module Overview (Technical)
- Module Overview (Commercial/Business)
- Module Overview (End User/Administrator)
- Configuration Sections
- Settings Reference
- Common Scenarios & Examples
- Limitations & Important Notes
- Troubleshooting Tips
- Glossary
---
1. Module Overview (Technical)
What Are Firewall Settings?
Firewall Settings is a security configuration module that manages the system firewall (nftables) and intrusion detection (Fail2Ban). This module works with related Firewall Services and Firewall Rules modules for complete traffic control.
Architecture
┌─────────────────────────────────────────────────────────────────┐
│ Firewall System Architecture │
├─────────────────────────────────────────────────────────────────┤
│ │
│ Firewall Settings │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ Global Configuration │ │
│ │ │ │
│ │ Firewall (nftables): │ │
│ │ └─ Enable/Disable │ │
│ │ │ │
│ │ Intrusion Detection (Fail2Ban): │ │
│ │ ├─ Enable/Disable │ │
│ │ ├─ Failed Attempts: 5 │ │
│ │ ├─ Find Time: 10 minutes │ │
│ │ ├─ Ban Duration: 60 minutes │ │
│ │ └─ Notification Email: admin@company.com │ │
│ │ │ │
│ └──────────────────────────────────────────────────────────┘ │
│ │ │
│ ▼ Works with │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ │ │
│ │ Firewall Services Firewall Rules │ │
│ │ ┌────────────────┐ ┌────────────────┐ │ │
│ │ │ HTTP: TCP/80 │ │ Allow HTTP │ │ │
│ │ │ HTTPS: TCP/443 │ → │ Block SSH │ │ │
│ │ │ SIP: UDP/5060 │ │ Accept SIP LAN │ │ │
│ │ │ SSH: TCP/22 │ │ Drop Others │ │ │
│ │ └────────────────┘ └────────────────┘ │ │
│ │ │ │
│ └──────────────────────────────────────────────────────────┘ │
│ │ │
│ ▼ Applied to system │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ Linux Firewall │ │
│ │ │ │
│ │ nftables: │ │
│ │ ├─ Input chain rules │ │
│ │ ├─ Output chain rules │ │
│ │ └─ Forward chain rules │ │
│ │ │ │
│ │ Fail2Ban: │ │
│ │ ├─ SSH jail │ │
│ │ ├─ SIP jail │ │
│ │ └─ Web jail │ │
│ │ │ │
│ └──────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────┘
Key Tables
| Table | Purpose |
|---|
public.firewall_settings | Global settings | |
public.firewall_services | Service definitions | |
public.firewall_rules | Traffic rules |
Key Files
| File | Description |
|---|
modules/firewallSettings/ | Settings module | |
modules/firewallServices/ | Services module | |
modules/firewallRules/ | Rules module | |
/etc/nftables.conf | nftables config | |
/etc/fail2ban/ | Fail2Ban config |
2. Module Overview (Commercial/Business)
Business Value
Firewall Settings provides network security:
| Without Firewall | With Firewall |
|---|
| Open ports | Controlled access | |
| No protection | Intrusion detection | |
| Manual bans | Automatic bans | |
| Unknown attacks | Email alerts |
Use Cases
- Network Protection
- Block unauthorized access
- Allow only needed ports
- Intrusion Prevention
- Detect brute force
- Auto-ban attackers
- SIP Security
- Protect SIP ports
- Ban SIP scanners
- Compliance
- Audit trail
- Security controls
Feature Highlights
| Feature | Benefit |
|---|
| nftables | Modern Linux firewall | |
| Fail2Ban | Intrusion detection | |
| Auto-Ban | Automatic blocking | |
| Email Alerts | Attack notifications | |
| Services | Reusable port definitions | |
| Priority Rules | Ordered evaluation |
3. Module Overview (End User/Administrator)
What Can You Do?
- Enable/disable system firewall
- Enable/disable intrusion detection
- Configure failed attempt limits
- Set ban duration
- Configure email alerts
- Define firewall services
- Create firewall rules
Firewall Settings Interface
┌─────────────────────────────────────────────────────────────────┐
│ Firewall Settings │
├─────────────────────────────────────────────────────────────────┤
│ │
│ Configure system firewall and intrusion detection │
│ │
│ ┌─────────────────────────────────────────────────────────────┐│
│ │ ││
│ │ Enable Firewall: ✓ ││
│ │ Enable or disable the system firewall (nftables) ││
│ │ When enabled, the firewall will enforce all rules ││
│ │ ││
│ └─────────────────────────────────────────────────────────────┘│
│ │
│ ──────────────────────────────────────────────────────────────│
│ │
│ ▼ Intrusion Detection (Fail2Ban) │
│ │
│ ┌─────────────────────────────────────────────────────────────┐│
│ │ ││
│ │ Enable Intrusion Detection: ✓ ││
│ │ Enable Fail2Ban to automatically ban IPs after ││
│ │ failed login attempts ││
│ │ ││
│ │ ────────────────────────────────────────────────────────── ││
│ │ ││
│ │ Failed Attempts Allowed: [5 ] ││
│ │ Number of failed attempts before ban (1-20) ││
│ │ ││
│ │ Find Time Window: [10 ] minutes ││
│ │ Time window to count failed attempts ││
│ │ ││
│ │ Ban Duration: [60 ] minutes ││
│ │ Duration that an IP will be banned ││
│ │ ││
│ │ Notification Email: [admin@company.com ] ││
│ │ Email address to receive ban notifications ││
│ │ ││
│ └─────────────────────────────────────────────────────────────┘│
│ │
│ [Save Settings] │
│ │
└─────────────────────────────────────────────────────────────────┘
Firewall Services Interface
┌─────────────────────────────────────────────────────────────────┐
│ Firewall Services │
├─────────────────────────────────────────────────────────────────┤
│ │
│ Manage firewall services for nftables (Debian 13) │
│ │
│ [+ Add Service] │
│ │
│ [🔍 Search services...] │
│ │
│ ┌───────────────────────────────────────────────────────────┐ │
│ │ Name │ Protocol │ Port │ Description │ Status│ │
│ ├──────────┼──────────┼───────────┼────────────────┼───────┤ │
│ │ HTTP │ TCP │ 80 │ Web traffic │ ● │ │
│ │ HTTPS │ TCP │ 443 │ Secure web │ ● │ │
│ │ SSH │ TCP │ 22 │ Secure shell │ ● │ │
│ │ SIP │ UDP │ 5060 │ SIP signaling │ ● │ │
│ │ RTP │ UDP │ 16384-32768│ Voice media │ ● │ │
│ └───────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────┘
Firewall Rules Interface
┌─────────────────────────────────────────────────────────────────┐
│ Firewall Rules │
├─────────────────────────────────────────────────────────────────┤
│ │
│ Manage firewall rules for nftables (Debian 13) │
│ │
│ [+ Add Rule] [Apply Rules] │
│ │
│ [🔍 Search rules...] │
│ │
│ ┌───────────────────────────────────────────────────────────┐ │
│ │ Name │ Action │ Direction│ Service │ Priority│ St │ │
│ ├──────────────┼────────┼──────────┼─────────┼─────────┼────┤ │
│ │ Allow HTTP │ Accept │ Input │ HTTP │ 100 │ ● │ │
│ │ Allow HTTPS │ Accept │ Input │ HTTPS │ 110 │ ● │ │
│ │ Allow SIP │ Accept │ Input │ SIP │ 200 │ ● │ │
│ │ Allow RTP │ Accept │ Input │ RTP │ 210 │ ● │ │
│ │ Block SSH Ext│ Drop │ Input │ SSH │ 300 │ ● │ │
│ └───────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────┘
Add/Edit Rule Modal
┌─────────────────────────────────────────────────────────────────┐
│ Add Firewall Rule │
├─────────────────────────────────────────────────────────────────┤
│ │
│ Rule Name: [Allow SIP from LAN ] │
│ Descriptive name for the rule │
│ │
│ Action: [Accept ▼] │
│ Accept | Drop | Reject │
│ │
│ Direction: [Input ▼] │
│ Input | Output | Forward │
│ │
│ Service: [SIP ▼] │
│ Select service (required) │
│ │
│ Priority: [200 ] │
│ Lower numbers evaluated first (0-9999) │
│ │
│ Source Address: [192.168.1.0/24 ] │
│ Optional: IP or CIDR │
│ │
│ Destination Address: [ ] │
│ Optional: IP or CIDR │
│ │
│ Interface: [eth0 ] │
│ Optional: Network interface │
│ │
│ Enabled: ✓ │
│ │
│ [Save] [Cancel] │
│ │
└─────────────────────────────────────────────────────────────────┘
Quick Tips
TIP
Apply Rules: Click "Apply Rules" after changes.
TIP
Priority: Lower numbers = higher priority.
WARNING
Don't Lock Yourself Out: Always allow SSH from your IP first!
---
4. Configuration Sections
Firewall Settings
| Field | Description |
|---|
| Enable Firewall | nftables on/off | |
| Enable Intrusion Detection | Fail2Ban on/off | |
| Failed Attempts | Max attempts (1-20) | |
| Find Time | Count window (minutes) | |
| Ban Duration | Ban time (minutes) | |
| Notification Email | Alert recipient |
Firewall Services
| Field | Description |
|---|
| Name | Service identifier | |
| Protocol | TCP, UDP, ICMP, All | |
| Port | Port or range (e.g., 8000-8010) | |
| Description | Optional notes | |
| Enabled | Active/Inactive |
Firewall Rules
| Field | Description |
|---|
| Name | Rule identifier | |
| Action | Accept, Drop, Reject | |
| Direction | Input, Output, Forward | |
| Service | Associated service | |
| Priority | Order (0-9999) | |
| Source Address | Source IP/CIDR | |
| Destination Address | Dest IP/CIDR | |
| Interface | Network interface | |
| Enabled | Active/Inactive |
5. Settings Reference
Rule Actions
| Action | Behavior | Use Case |
|---|
| Accept | Allow traffic | Legitimate traffic | |
| Drop | Silent block | Stealth blocking | |
| Reject | Block with response | Inform sender |
Rule Directions
| Direction | Description |
|---|
| Input | Traffic TO the server | |
| Output | Traffic FROM the server | |
| Forward | Routed traffic |
Common Protocols
| Protocol | Use |
|---|
| TCP | HTTP, HTTPS, SSH, SIP-TCP | |
| UDP | SIP, RTP, DNS | |
| ICMP | Ping | |
| All | Any protocol |
Fail2Ban Recommendations
| Setting | Default | Aggressive | Permissive |
|---|
| Failed Attempts | 5 | 3 | 10 | |
| Find Time | 10 min | 5 min | 30 min | |
| Ban Duration | 60 min | 1440 min (24h) | 30 min |
6. Common Scenarios & Examples
Scenario 1: Enable Firewall & Detection
- Enable Firewall = ✓
- Enable Intrusion Detection = ✓
- Failed Attempts = 5
- Find Time = 10 minutes
- Ban Duration = 60 minutes
- Email = admin@company.com
- Save
Scenario 2: Create SIP Service
- Add Service
- Name = "SIP"
- Protocol = UDP
- Port = 5060
- Description = "SIP signaling"
- Enable = ✓
- Save
Scenario 3: Allow SIP from LAN Only
- Add Rule
- Name = "Allow SIP LAN"
- Action = Accept
- Direction = Input
- Service = SIP
- Priority = 200
- Source = 192.168.1.0/24
- Enable = ✓
- Save
- Apply Rules
Scenario 4: Block External SSH
- First: Create "Allow SSH from Admin IP" rule (Priority 90)
- Add Rule
- Name = "Block SSH External"
- Action = Drop
- Direction = Input
- Service = SSH
- Priority = 100
- Enable = ✓
- Save
- Apply Rules
---
7. Limitations & Important Notes
Technical Notes
NOTE
Apply Required: Rules don't take effect until applied.
NOTE
Priority Order: Lower number = evaluated first.
CAUTION
SSH Access: Always allow your IP before blocking!
Best Practices
- SSH First: Always allow admin SSH
- Specific to General: Specific rules before broad rules
- Test Changes: Verify access after changes
- Enable Fail2Ban: Protect against brute force
- Monitor Bans: Check for false positives
Common Services to Allow
| Service | Port | Notes |
|---|
| HTTP | 80 | Web (redirect to HTTPS) | |
| HTTPS | 443 | Secure web | |
| SIP UDP | 5060 | SIP signaling | |
| SIP TLS | 5061 | Secure SIP | |
| RTP | 16384-32768 | Voice media | |
| SSH | 22 | Remote admin (restrict!) |
8. Troubleshooting Tips
Common Issues
| Symptom | Possible Cause | Solution |
|---|
| Can't connect | Blocked by firewall | Check rules | |
| False bans | Fail2Ban too strict | Adjust settings | |
| Rules not working | Not applied | Click Apply Rules | |
| Locked out | SSH blocked | Console access |
Check Firewall Status
# Check nftables
nft list ruleset
# Check Fail2Ban status
fail2ban-client status
# Check specific jail
fail2ban-client status sshd
# Unban an IP
fail2ban-client set sshd unbanip 192.168.1.100
Check Bans
# View banned IPs
fail2ban-client status sshd
# Check ban log
tail -f /var/log/fail2ban.log
# View all bans
iptables -L -n | grep -i ban
---
9. Glossary
| Term | Definition |
|---|
| nftables | Linux firewall framework | |
| Fail2Ban | Intrusion detection system | |
| Jail | Fail2Ban protection scope | |
| CIDR | IP range notation | |
| Chain | Rule processing group | |
| Input Chain | Incoming traffic rules |
Lua Script Status ℹ️
Security Module
| Component | Status |
|---|
| Firewall Settings | ℹ️ nftables/Fail2Ban config - no Lua handler required | |
| Firewall Services | ℹ️ Port definitions - no Lua handler required | |
| Firewall Rules | ℹ️ Traffic rules - no Lua handler required |
---
Documentation last updated: January 2026
