{"id":18841938,"url":"https://github.com/ahmetozer/zabita","last_synced_at":"2025-08-23T23:19:51.121Z","repository":{"id":136065584,"uuid":"530726385","full_name":"ahmetozer/zabita","owner":"ahmetozer","description":"Zabita is an easy method for handling packet filtering with help of iptables and tun-tap interfaces.","archived":false,"fork":false,"pushed_at":"2022-09-03T22:40:59.000Z","size":7,"stargazers_count":5,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-07-13T09:38:42.194Z","etag":null,"topics":["conntrack","firewall","golang","iptables","ipv4","ipv6","linux"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ahmetozer.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-08-30T15:50:52.000Z","updated_at":"2023-05-12T17:09:17.000Z","dependencies_parsed_at":null,"dependency_job_id":"b618b2ad-cea2-46f5-8c6f-c402366b848b","html_url":"https://github.com/ahmetozer/zabita","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/ahmetozer/zabita","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ahmetozer%2Fzabita","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ahmetozer%2Fzabita/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ahmetozer%2Fzabita/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ahmetozer%2Fzabita/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ahmetozer","download_url":"https://codeload.github.com/ahmetozer/zabita/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ahmetozer%2Fzabita/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":269780615,"owners_count":24474682,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-10T02:00:08.965Z","response_time":71,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["conntrack","firewall","golang","iptables","ipv4","ipv6","linux"],"created_at":"2024-11-08T02:53:07.472Z","updated_at":"2025-08-10T20:05:06.829Z","avatar_url":"https://github.com/ahmetozer.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Zabita\n\nZabita is an easy method for handling packet filtering with help of iptables and tun-tap interfaces.\n\n## The way of work\n\nZabita will create a new tun interface on your system to receive a packet and return back to the system.\nIptables will drop default incoming packets and reflect the Zabita, your golang algorithm will process the packet and if it meets the requirements, systems will turn back the packet any system processes that packet instead of the real packet which comes from your real interface.\n\nWith this approach, you don't need to create lots of iptables rules or you can create dynamically manageable rules in your program which iptables are not capable to do.\n\n## Building Main\n\nResponsibility for the main process is creating a tunnel interface and preparing the system for handling the new packets and dynamic reloading.\n\n```bash\ngo build -o zabita\n```\n\n## Buiding packet processing plugin\n\nTo achieve the dynamic reloading of the system without making binary changes to the main function, we need to compile our packet filter function separately.\n\nTwo functions are exposed to the main process, the first one is `CheckFW` which is executed when each packet arrives at the system and the other one is Main, which is execute once at the plugin load stage.\n\n```bash\ngo build -buildmode=plugin -o zabita_rule.so zabita_rule.go\n```\n\nYou can find more in the `/example` folder.\n\n## Forwarding packets to zabita\n\nYou can forward all incoming packets to inspect every incoming data to your server or for lower CPU usage you can just bypass the first packet to determine connection will start or drop.\n\nFor new connections only\n\n```bash\nIPv4\niptables -t mangle -I PREROUTING -i eth0 -m conntrack --ctstate NEW -j TEE --gateway 169.254.20.255\niptables -t mangle -A PREROUTING -i eth0 -m conntrack --ctstate NEW -j DROP\n# IPv6\nip6tables -t mangle -I PREROUTING -i eth0 -m conntrack --ctstate NEW -j TEE --gateway fd:900d:cafe:7a61:6269:7461::1\nip6tables -t mangle -A PREROUTING -i eth0 -m conntrack --ctstate NEW -j DROP\n```\n\nFor all incoming packets\n\n```bash\nIPv4\niptables -t mangle -I PREROUTING -i eth0 -j TEE --gateway 169.254.20.255\niptables -t mangle -A PREROUTING -i eth0 -j DROP\n# IPv6\niptables -t mangle -I PREROUTING -i eth0 -j TEE --gateway fd:900d:cafe:7a61:6269:7461::1\niptables -t mangle -A PREROUTING -i eth0 -j DROP\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fahmetozer%2Fzabita","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fahmetozer%2Fzabita","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fahmetozer%2Fzabita/lists"}