{"id":17069594,"url":"https://github.com/freethenation/rfw","last_synced_at":"2026-05-03T10:34:14.229Z","repository":{"id":144601114,"uuid":"59451312","full_name":"freethenation/rfw","owner":"freethenation","description":"\"ouRFireWall\" is a simple, bash-only iptables firewall script focused on Linux container networking","archived":false,"fork":false,"pushed_at":"2016-06-16T08:11:43.000Z","size":11,"stargazers_count":0,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-10-04T13:44:57.989Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/freethenation.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2016-05-23T04:09:21.000Z","updated_at":"2019-10-17T02:20:47.000Z","dependencies_parsed_at":null,"dependency_job_id":"12e04395-59a3-4543-8293-56fef6f56a6e","html_url":"https://github.com/freethenation/rfw","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/freethenation/rfw","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/freethenation%2Frfw","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/freethenation%2Frfw/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/freethenation%2Frfw/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/freethenation%2Frfw/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/freethenation","download_url":"https://codeload.github.com/freethenation/rfw/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/freethenation%2Frfw/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32566444,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-03T06:36:36.687Z","status":"ssl_error","status_checked_at":"2026-05-03T06:36:09.306Z","response_time":103,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-14T11:27:20.089Z","updated_at":"2026-05-03T10:34:14.205Z","avatar_url":"https://github.com/freethenation.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"rfw\n---\n\"ouRFireWall\" is a simple, bash-only iptables firewall script focused on Linux\ncontainer networking. It only handles port forwarding and NAT for configured\ncontainers. Use something like UFW or Shorewall (or just raw iptables) to handle\nthe INPUT and OUTPUT chains.\n\nConfiguration\n-------------\nExample config file:\n```\n#dtype    dspec            protocol  port     dport\n#--------------------------------------------------\ndocker    grafana          tcp       8080     80\nlxc       blah             tcp       192      22\neth0      10.0.3.1         tcp       234      123\neth1      2001:db8::1      udp       53       53\ndocker    monitor\n```\n\nEach line has up to five configuration settings. The first two are required:\n\n* `dtype` \"Destination Type\":  \n  One of \"docker\", \"lxc\", or an interface. This indicates how the remainder of\n  the line is to be interpreted.\n\n* `dspec` \"Destination Specification\":  \n  Name of a container, or a raw IPv4/IPv6 address. Together with `dtype`, this\n  will be used to find the IP address and interface for the configuration line.\n  If a raw IP address is used, `dtype` must be an interface on the host that can\n  communicate with that IP. This can be used to set up basic NAT + forwarding\n  for any container or VM service, or even for weird cases like fixed host VPNs.\n\nThe remaining three are optional, and only used when forwarding ports to a\ncontainer. If they are omitted, no ports will be forwarded to the container,\nbut it will still be NAT'd with the host, giving it access to the internet.\n\n* `protocol`:  \n  The protocol of traffic to forward to the container.\n\n* `port` \"Host Port\":  \n  The port that the forwarded traffic will use on the HOST side.\n\n* `dport` \"Destination Port\":  \n  The port that is listening for traffic inside the container.\n\nUse with Containers\n-------------------\nTo use this with docker, add the following to your docker daemon options (found\nin `/etc/default/docker` on Ubuntu):\n```\n--ipv6 --iptables=false --userland-proxy=false\n```\n\nUnfortunately, LXC does not have an easy way to disable its own iptables rule\ncreation like docker. To use this with LXC, you'll need to modify the `lxc-net`\njob (found in `/etc/init/lxc-net.conf` on Ubuntu 14.04, but probably moved on\nsystemd distros). Simply remove or comment out any lines that affect iptables.\n\nUFW\n---\nSince this firewall only handles forwarding and NAT, you'll still want a simple\nhost-level firewall to protect your container host. I recommend UFW because it's\nsupremely simple to set up. Here's a 30 second example:\n```bash\nsudo ufw logging off   # disable noisy logging\nsudo ufw allow 22/tcp  # allow SSH port\nsudo ufw enable        # enable your new firewall\n```\nThere is no need to allow access to your containerized services in UFW, as the\nforwarding script will ensure that they can be accessed both from localhost as\nwell as from all other interfaces.\n\nIPv6\n----\nThis script NATs both IPv4 and IPv6, based on the idea that containers are\nreally just chroots on steroids. We'd like to make it seem as if the service is\nrunning directly on this host, and that means sharing the same IPv4 and IPv6\naddress as this host.\n\nContributing\n------------\nThis code is MIT licensed. See the LICENSE.txt file for details. Pull requests\nare always welcome!\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffreethenation%2Frfw","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffreethenation%2Frfw","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffreethenation%2Frfw/lists"}