Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/sir-go/rkn-rejects

extremely strict parental control for RKN device
https://github.com/sir-go/rkn-rejects

dns docker dpi go nfqueue nftables sniffing

Last synced: 7 days ago
JSON representation

extremely strict parental control for RKN device

Host: GitHub
URL: https://github.com/sir-go/rkn-rejects
Owner: sir-go
Created: 2022-10-24T02:48:40.000Z (about 2 years ago)
Default Branch: main
Last Pushed: 2023-02-18T03:06:37.000Z (almost 2 years ago)
Last Synced: 2024-11-06T22:08:35.605Z (about 2 months ago)
Topics: dns, docker, dpi, go, nfqueue, nftables, sniffing
Language: Go
Homepage:
Size: 76.2 KB
Stars: 0
Watchers: 1
Forks: 0
Open Issues: 1
Metadata Files:
- Readme: README.md

Awesome Lists containing this project

README

        # DNS/DPI sniffers and NFT-tables rules

[![Go Test cmd/checks](https://github.com/sir-go/rkn-rejects/actions/workflows/go-check.yml/badge.svg)](https://github.com/sir-go/rkn-rejects/actions/workflows/go-check.yml)

[![Go Test cmd/dns](https://github.com/sir-go/rkn-rejects/actions/workflows/go-dns.yml/badge.svg)](https://github.com/sir-go/rkn-rejects/actions/workflows/go-dns.yml)

[![Go Test cmd/dpi](https://github.com/sir-go/rkn-rejects/actions/workflows/go-dpi.yml/badge.svg)](https://github.com/sir-go/rkn-rejects/actions/workflows/go-dpi.yml)

[![Go Test cmd/get-rkn](https://github.com/sir-go/rkn-rejects/actions/workflows/go-get-rkn.yml/badge.svg)](https://github.com/sir-go/rkn-rejects/actions/workflows/go-get-rkn.yml)

The parental control project contains four utilities to get white and black lists from RKN service and 

completely isolate one certain host from denied resources. Utilities installed at the router between

the host and uplink.

## Utilities

 - [get_rkn](cmd/get_rkn)

    SOAP-client for [RKN service](https://vigruzki.rkn.gov.ru/services/OperatorRequest/?wsdl), 

    gets b/w lists, parses them and fills the redis cache.

    

 - [dns-sniffer](cmd/dns-sniffer)

    watches all DNS traffic, collects A-records, and checks resolved hosts by b/w lists.

    

    If the record in the answer is not denied then it puts to the white IP list with resolved TTL.

 - [dpi-sniffer](cmd/dpi-sniffer)

    sniffs all traffic and for denied IP or hostname detection.

 - [check](cmd/check)

    the testing tool for regularly checking the quality of other parts working. It gets the 

    accessibility of hosts by their list in Redis, runs goroutines with HTTP-clients, and collects status codes.

    It can be run from the docker container for routing all traffic through the router's firewall.

## NF-tables

Traffic to sniffers redirects by the `nf_queue` kernel module. All traffic rejects by default 

except DNS requests and answers. NF-tables rules have a list of allowed IP addresses. 

Every record in the list has a TTL and deletes when this time is expired.

Also, there are the lists filled manually and imported to the rules.

Utilities control the firewall with internal library [internal/fw](internal/fw).

Predefined useful nftables configs located in [configs/nftables](configs/nftables)