V18 network and firewall updates 🧱

FreePBX Development
, ,
1

As mentioned in a previous comment from YT What would you like to see added in FreePBX 18? - #77 by penguinpbx, we are moving to native nftables rule manipulation in v18. Observant readers may note that the firewall module’s legacy/previous use of iptables was as of late but a wrapper around nftables by way of iptables-nft in FreePBX 17 on Debian 12 e.g. try running sudo nft list table ip filter | head and you should see amongst the output something like # Warning: table ip filter is managed by iptables-nft, do not touch!

Good news – these initial changes for native nftables support have now made their way into the v18 branch of the firewall module – big hat tip to @jphilip for this major update! :cowboy_hat_face:

New to nftables ?

  • Upgrade tools for custom firewall rules in /etc/firewall-4.rules are included via that commit – you’ll be able to run fwconsole firewall migrate_rules for the one-way conversion trip during your v18 upgrade (new custom rules can be added to /etc/firewall.nft at least per this current commit.)
  • Also take a look at this great video from @joebeasley3rd Adding an IP Set - #6 by joebeasley3rd showing some practical GeoIP integration with nftables and a MERICA set. :united_states:

Speaking of which, this work helps pave the way for faster and friendlier GeoIP blocking, better IPv6 handling, integration with external tools e.g. APIBAN now has NFTABLES client by @fredposner and more!

3

Thanks @penguinpbx –

apiban-client-nftables is really solid and protects against both known SIP and known HTTP attackers. It also allows you determine how long to keep active known IPs blocked as well as some other options. We also have a local api for your system to block ip’s at will (nftables-api).

And, of course it’s free (as in beer).

Have a great weekend!