{"id":28851493,"url":"https://github.com/sonnyson-p/linux-based-firewall","last_synced_at":"2025-08-12T17:41:04.915Z","repository":{"id":297596057,"uuid":"996921446","full_name":"SonnySon-P/Linux-based-Firewall","owner":"SonnySon-P","description":"A self-made Linux-based firewall that can block malicious IPs and Ports.","archived":false,"fork":false,"pushed_at":"2025-06-06T09:33:03.000Z","size":1758,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-06-19T21:05:09.172Z","etag":null,"topics":["c","firewall","ip","netfilter-queue","tcp-port","udp-port"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SonnySon-P.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-06-05T17:06:11.000Z","updated_at":"2025-06-06T09:33:05.000Z","dependencies_parsed_at":"2025-06-06T10:43:41.555Z","dependency_job_id":null,"html_url":"https://github.com/SonnySon-P/Linux-based-Firewall","commit_stats":null,"previous_names":["sonnyson-p/linux-based-firewall"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/SonnySon-P/Linux-based-Firewall","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SonnySon-P%2FLinux-based-Firewall","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SonnySon-P%2FLinux-based-Firewall/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SonnySon-P%2FLinux-based-Firewall/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SonnySon-P%2FLinux-based-Firewall/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SonnySon-P","download_url":"https://codeload.github.com/SonnySon-P/Linux-based-Firewall/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SonnySon-P%2FLinux-based-Firewall/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":270108329,"owners_count":24528758,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-12T02:00:09.011Z","response_time":80,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["c","firewall","ip","netfilter-queue","tcp-port","udp-port"],"created_at":"2025-06-19T21:05:08.090Z","updated_at":"2025-08-12T17:41:04.888Z","avatar_url":"https://github.com/SonnySon-P.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Linux based Firewall\n\n自製一套基於Linux核心的防火牆，可以有效阻擋惡意IP跟Port。\n\n## 壹、基本說明\n**ㄧ、動機：**\n隨著近期資安議題日益升溫，關於防範機制的討論與創新也持續不斷。然而，在眾多防護手段中，最為經典且基礎的資訊安全措施-防火牆，依然是目前最有效且被廣泛應用的防禦機制。無論是路由器還是電腦，防火牆在各種網路環境中扮演著至關重要的角色，形成了資訊安全的第一道防線。基於此，本文將從學術研究的角度出發，著手開發一套防火牆系統，旨在為教學提供一個示範工具，並藉此加深對現代資訊安全防範技術的理解與應用。\n\n**二、設計概念：**\n該系統的主要目的是有效阻擋來自惡意IP和Port的攻擊流量，並提供一個高效的防護機制。系統基於Linux操作平台，並利用NFQUEUE機制來實現這一功能。NFQUEUE是Linux Netfilter框架提供的一個強大功能，它能夠將進來的封包轉交給用戶空間的程式進行進一步的處理。當封包被加入到隊列後，開發者編寫的應用程式便可以檢查這些封包的內容，根據預定的安全策略，進行修改或決定是否丟棄該封包。這樣的機制不僅增強了防禦效果，還能根據實際需求對封包流量進行細緻的監控與管理，從而有效抵禦各種惡意攻擊。\n\n**三、開發環境：**\n* 虛擬機：VirtualBox\n* 作業系統：Ubuntu 22.04\n* 程式語言：C\n* 程式編輯器：Visual Studio Code\n\n**四、檔案說明：**\n```bash\n.\n├── LICENSE\n├── README.md\n└──  Firewall  # 開發程式資料夾\n      ├── main.c  # 主程式\n      ├── variables.h  # 定義變數（標頭檔）\n      ├── sharedFunctions.h  # 共用函式（標頭檔）\n      ├── sharedFunctions.c  # 共用函式\n      ├── manageBlocklist.h  # 管理封鎖名單（標頭檔）\n      ├── manageBlocklist.c  # 管理封鎖名單\n      ├── executeFirewall.h  # 執行防火牆（標頭檔）\n      ├── executeFirewall.c  # 執行防火牆\n      ├── viewLogs.h  # 查詢日誌（標頭檔）\n      ├── viewLogs.c  # 查詢日誌\n      ├── blocklist.conf  # 封鎖名單\n      ├── firewall.log  # 日誌\n      └── firewall  # Unix執行檔\n```\n\n## 貳、運行方式\n**一、運行方式：**\n1. 安裝套件\n   ```shell\n   sudo apt update\n   sudo apt update\n   sudo apt install build-essential\n   sudo apt install linux-headers-$(uname -r)\n   sudo apt install libnetfilter-queue-dev\n   sudo apt install libnfnetlink-dev\n   ```\n\n2. 至executeFirewall.c的160行，添加root的密碼\n   ```shell\n   reply = system(\"echo '你的密碼' | sudo iptables -I INPUT -j NFQUEUE --queue-num 0\");\n   ```\n\u003e [!Warning]\n\u003e 請特別注意，以上程式碼主要功能是將進入主機的封包導入到Netfilter Queue，為重要系統運行關鍵步驟。所以，若出現\"System command failed. 'sudo iptables -I INPUT -j NFQUEUE --queue-num 0' is not executed.\"時，可嘗試手動在終端機執行\"sudo iptables -I INPUT -j NFQUEUE --queue-num 0\"。\n   \n3. 編譯程式\n   ```shell\n   gcc -D_GNU_SOURCE -o firewall main.c manageBlocklist.c executeFirewall.c sharedFunctions.c viewLogs.c -lnetfilter_queue\n   ```\n\n4. 運行程式\n   ```shell\n   sudo ./firewall\n   ```\n\n5. 清空所有的iptables規則（非必要）\n   ```shell\n   sudo iptables -F\n   ```\n\u003e [!Warning]\n\u003e 請特別注意，若有發生網路連線發生異常，請於終端機嘗試執行\"sudo iptables -F\"。\n\n**二、運行結果：** 部分功能截圖\n1. 主選單\n\u003cbr\u003e\n  \u003cdiv align=\"center\"\u003e\n  \t\u003cimg src=\"./截圖1.png\" alt=\"Editor\" width=\"500\"\u003e\n  \u003c/div\u003e\n\u003cbr\u003e\n\n2. 管理封鎖名單選單\n\u003cbr\u003e\n  \u003cdiv align=\"center\"\u003e\n  \t\u003cimg src=\"./截圖2.png\" alt=\"Editor\" width=\"500\"\u003e\n  \u003c/div\u003e\n\u003cbr\u003e\n\n3. 管理IP封鎖名單選單\n\u003cbr\u003e\n  \u003cdiv align=\"center\"\u003e\n  \t\u003cimg src=\"./截圖3.png\" alt=\"Editor\" width=\"500\"\u003e\n  \u003c/div\u003e\n\u003cbr\u003e\n\n4. 刪除IP封鎖名單\n\u003cbr\u003e\n  \u003cdiv align=\"center\"\u003e\n  \t\u003cimg src=\"./截圖4.png\" alt=\"Editor\" width=\"500\"\u003e\n  \u003c/div\u003e\n\u003cbr\u003e\n\n5. 執行防火牆\n\u003cbr\u003e\n  \u003cdiv align=\"center\"\u003e\n  \t\u003cimg src=\"./截圖5.png\" alt=\"Editor\" width=\"500\"\u003e\n  \u003c/div\u003e\n\u003cbr\u003e\n\n6. 顯示日誌\n\u003cbr\u003e\n  \u003cdiv align=\"center\"\u003e\n  \t\u003cimg src=\"./截圖6.png\" alt=\"Editor\" width=\"760\"\u003e\n  \u003c/div\u003e\n\u003cbr\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsonnyson-p%2Flinux-based-firewall","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsonnyson-p%2Flinux-based-firewall","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsonnyson-p%2Flinux-based-firewall/lists"}