jpylypiw/easywall

Web interface for easy use of the IPTables firewall on Linux systems written in Python3.

easywall

---

Firewalls are becoming increasingly important in today's world. Hackers and automated scripts are constantly trying to invade your system and use it for Bitcoin mining, botnets or other things.

To prevent these attacks, you can use a firewall on your system. IPTables is the strongest firewall in Linux because it can filter packets in the kernel before they reach the application. Using IPTables is not very easy for Linux beginners. We have created easywall - the simple IPTables web interface. The focus of the software is on easy installation and use.

---

Demo

The demo is currently not available because a new server has to be installed for this purpose.

You can view an online version of the program as a demo under the following link:

https://addurlhere (Certificate is provided by Let's Encrypt)

• Username: demo
• Password: demo

The online demo version is reset every 30 minutes and all data is deleted. The demo has only the frontend installed without the backend. Configuration changes are therefore not saved or applied.

---

Quick Start

This guide refers to the easiest way to install using the APT Package Manager. For detailed installation instructions, please refer to the documentation.

apt update
apt install -y apt-transport-https gnupg
echo "deb https://apt.wdkro.de/ stable main" > /etc/apt/sources.list.d/easywall.list
apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 67A12A6883B73731
apt update
apt install easywall

After installation, the web interface can be accessed in the browser at https://hostname-or-ip-address:12227.

---

Features

• Built-in rules - that can be activated by option.
• Logging - of blocked connections and many other stuff.
• IPv6 - is completely supported since it should be used on every system.
• Two step activation - Changed rules are activated in two steps to check the connection.
• Blacklisting and Whitelisting - of IP addresses and IPv6 addresses.
• Port Forwarding - Forward Ports through the Firewall.
• TCP, UDP and Port Ranges - Open them if you need them in the internet.
• Own IPTables rules - Can be managed in the web interface.
• Install and Update - The software can be installed and updated easily.
• Ansible role- For advanced users and automation.

---

Roadmap

The following features will be implemented in one of the next versions. If you need a feature, simply create a GitHub issue, and we'll include it here.

• ❌ finish all TODO: Docs documentations
• ❌ improve testing by using multiple os

---

Install

We provide extensive instructions on our installation page. You can find a script for automatic downloading and installation.

---

Ansible Role

We are currently working on an Ansible role that will allow easywall to be fully configured with Ansible.

The project can be found under the following link: ansible-role-easywall

---

Documentation

Check the docs folder for the software documentation.

---

License

easywall is GNU General Public License v3.0 +.

---

Support me

The project easywall was created in a time when I did not have any knowledge about Linux. Today I work as an administrator for Linux systems and would not need this project anymore. Nevertheless it is important to me to support the introduction to Linux and the use and simplification of firewalls.

To continue the project, I need your support! Please donate so that I can continue the project in my spare time. Every dollar counts! You can find a donation link on GitHub.

---

What does it look like

easywall's Issues

E: The repository 'https://apt.wdkro.de stable InRelease' is not signed.

Custom rules do not apply (ip whitelist with custom rules)

Hello

Context

I'd like to accept incomming data from a single IP using custom rules.

Scenario

• Add the following IP Rules (replace with real IP) -A INPUT -p tcp -s x.y.z.a -j ACCEPT
• Apply rules
• Check iptables and try to acces the host with the previous IP
• ❌The IP is not present in iptables rules and I am not able to access the host with this IP
• Remove the custom rule and add the whitelist IP using the Whitelist menu.
• ✔The IP is visible in iptables rules and I AM able to access the host with this IP

Could you please advice ? Am I doing something wrong or is there a code-issue ?

Best regards

fail build

apt update
apt install -y apt-transport-https gnupg
echo "deb https://apt.wdkro.de/ stable main" > /etc/apt/sources.list.d/easywall.list
apt-key adv --keyserver keyserver.ubuntu.com --recv-keys D88D7689C1624EE3
apt update
apt install easywall

When I run the above command I get the following error.
Tried on Ubuntu 18.04 and Debian10!

chown: cannot access '/opt/easywall/rules': No such file or directory
failed to change ownership of '/opt/easywall/rules' to easywall:easywall
mode of '/opt/easywall' changed from 0755 (rwxr-xr-x) to 0750 (rwxr-x---)
mode of '/opt/easywall/config' changed from 0755 (rwxr-xr-x) to 0750 (rwxr-x---)
chmod: cannot access '/opt/easywall/rules': No such file or directory
failed to change mode of '/opt/easywall/rules' from 0000 (---------) to 0000 (---------)

ip-address:12227 is not working. I get the reply "The connection was reset".

Feature request: IP+PORT rules

Hi

Thanks for this amazing tool; helped me a lot.
I dont know if you accept/handle feature requests; at lest FYI, please find one below.

Summary

Provide a way to have more restricted rules that only accept if IP + PORT.

Actual

• You can whitelist IP, whitelisted IP bypass all port rules
• You can open port (others are by default closed).
• If you do not open port 1324 but whiteliste IP A.B.C.D then ip A.B.C.D is still able to access host:1234.

Request

A way to combine (AND) IP + PORT.
For instance:

• A global configuration that says "AND between IP and PORT", if checked all the rules are combined to only accept if IP + PORT.
• When adding an IP add a fields to also specify the PORT and tcp/udp.

Login error

I installed Easy Wall without any errors, I entered a login prompt of '1' and a password of '1', but when I try to enter the interface from another computer, I get a login and password error

Reverse proxy error 502

Is it possible to put this behind a reverse proxy? With a normal setup in Apache that works for most other services, I'm getting this error.

ProxyPass / http://127.0.0.1:12227/
ProxyPassReverse / http://127.0.0.1:12227/

I have tried forwarding websockets too, with no success.

Rewrite Warning

Hey there!
This project is no longer maintained.
I will create a new version of it on a different Branch so you can watch the progress.
The design using PHP and Bash in combination is not the correct way to set up iptables or anything you need root permissions. I will rewrite the application using Go and just serve a single file application which listens on a specific port. So you can bind it on localhost and reverse proxy using apache or any other webserver you want.

Request: enable management of remote iptables

Feature request, would it be possible to add management of remote iptables, and have shared objects (from a management perspective).

I'm unable to connect to the demo site, so apologies if this capability is already present.

Support for Nat loopback/hairpin?

Hi,

Currently I use UFW as my home server firewall, but still I can figure it out to make Nat Loopback/Harpin to work correctly. And since UFW does not have command rules for forwarding, I ask if Easywall does support this.

Thanks.

Setup error

Hi all :)

If setup easywell ín Debian System, error message.

Setup code:
"echo "deb https://apt.wdkro.de/ stable "
This link not found.
Program install not full.

Feature request: Comment column

Hello,

Please consider adding additional field "Comment". With this field it will be easier to identify IPs.

Example of iptables rule:

-A INPUT -s X.X.X.X/32 -p tcp -m tcp --dport 161 -m conntrack --ctstate NEW -m comment --comment "SNMP Monitoring TCP" -j ACCEPT

Demo url with error

On the date 2020/07/19 when accessing the link
https://dev01vt.wdkro.de:12227/
By firefox browser
returned the following error:
Internal Server Error

Doesn't apply port-range rules

Hello,
as the title say, if you specify a port range, like TCP 5280-5281, easywall doesn't set any rule for those ports.

Certificate is insecure - How to use my own

Hello,
in the standard configuration, SSL certs are insecure, no private connection can be established by chrome or firefox.

I tried using my let's encrypt certs, converting the fullchain.pem and private.pem to crt and key respectively but the web service is failing with the following error:

easywall-web[3886461]: [uwsgi-ssl] unable to assign certificate ssl/easywall.crt for context "0.0.0.0:12227"

So, can you explain how to use my own let's encrypt cert with easywall?

Thanks

Depfu Error: No dependency files found

Hello,

We've tried to activate or update your repository on Depfu and couldn't find any supported dependency files. If we were to guess, we would say that this is not actually a project Depfu supports and has probably been activated by error.

Monorepos

Please note that Depfu currently only searches for your dependency files in the root folder. We do support monorepos and non-root files, but don't auto-detect them. If that's the case with this repo, please send us a quick email with the folder you want Depfu to work on and we'll set it up right away!

How to deactivate the project

• Go to the Settings page of either your own account or the organization you've used
• Go to "Installed Integrations"
• Click the "Configure" button on the Depfu integration
• Remove this repo (jpylypiw/easywall) from the list of accessible repos.

Please note that using the "All Repositories" setting doesn't make a lot of sense with Depfu.

If you think that this is a mistake

Please let us know by sending an email to [email protected].

---

This is an automated issue by Depfu. You're getting it because someone configured Depfu to automatically update dependencies on this project.

how to uninstall

Hi,
how can i uninstall easywall?
I installed it this way:
cd /usr/local
git clone https://github.com/jpylypiw/easywall.git
cd easywall
sudo chmod +x install.sh
sudo bash install.sh

regards

port name

feature request for web gui:

Open port in firewall for incoming connections
assign custom name to port for simplified readability

save iptables on reboot

Although it is a beta, would it be possible to save the iptables on reboot?

Install

Hi Guys!

Once i have run the commands to install this, how do i access the web interface?

Also is this safe to install on a VPS server which is currently active and live with a website? or is it best to install on only fresh installs?

Cheers

Internal Server Error

Hi,

Nice and meaningful project. We would like to know if you have plans to expand from managing IP tables for a single host to the multi-host environment?

I have installed in Debian GNU/Linux 10 \n \l and it worked for one day and next day, I started getting Internal Server Error. Below is the log

grep easywall-web /var/log/syslog | tail -n 50

May  3 00:17:41 debian10 easywall-web[450]:     self.endheaders(body, encode_chunked=encode_chunked)
May  3 00:17:41 debian10 easywall-web[450]:   File "/usr/lib/python3.7/http/client.py", line 1255, in endheaders
May  3 00:17:41 debian10 easywall-web[450]:     self._send_output(message_body, encode_chunked=encode_chunked)
May  3 00:17:41 debian10 easywall-web[450]:   File "/usr/lib/python3.7/http/client.py", line 1030, in _send_output
May  3 00:17:41 debian10 easywall-web[450]:     self.send(msg)
May  3 00:17:41 debian10 easywall-web[450]:   File "/usr/lib/python3.7/http/client.py", line 970, in send
May  3 00:17:41 debian10 easywall-web[450]:     self.connect()
May  3 00:17:41 debian10 easywall-web[450]:   File "/usr/lib/python3.7/http/client.py", line 1415, in connect
May  3 00:17:41 debian10 easywall-web[450]:     super().connect()
May  3 00:17:41 debian10 easywall-web[450]:   File "/usr/lib/python3.7/http/client.py", line 942, in connect
May  3 00:17:41 debian10 easywall-web[450]:     (self.host,self.port), self.timeout, self.source_address)
May  3 00:17:41 debian10 easywall-web[450]:   File "/usr/lib/python3.7/socket.py", line 707, in create_connection
May  3 00:17:41 debian10 easywall-web[450]:     for res in getaddrinfo(host, port, 0, SOCK_STREAM):
May  3 00:17:41 debian10 easywall-web[450]:   File "/usr/lib/python3.7/socket.py", line 748, in getaddrinfo
May  3 00:17:41 debian10 easywall-web[450]:     for res in _socket.getaddrinfo(host, port, family, type, proto, flags):
May  3 00:17:41 debian10 easywall-web[450]: socket.gaierror: [Errno -3] Temporary failure in name resolution
May  3 00:17:41 debian10 easywall-web[450]: During handling of the above exception, another exception occurred:
May  3 00:17:41 debian10 easywall-web[450]: Traceback (most recent call last):
May  3 00:17:41 debian10 easywall-web[450]:   File "/usr/local/lib/python3.7/dist-packages/flask/app.py", line 2447, in wsgi_app
May  3 00:17:41 debian10 easywall-web[450]:     response = self.full_dispatch_request()
May  3 00:17:41 debian10 easywall-web[450]:   File "/usr/local/lib/python3.7/dist-packages/flask/app.py", line 1952, in full_dispatch_request
May  3 00:17:41 debian10 easywall-web[450]:     rv = self.handle_user_exception(e)
May  3 00:17:41 debian10 easywall-web[450]:   File "/usr/local/lib/python3.7/dist-packages/flask/app.py", line 1816, in handle_user_exception
May  3 00:17:41 debian10 easywall-web[450]:     return self.handle_http_exception(e)
May  3 00:17:41 debian10 easywall-web[450]:   File "/usr/local/lib/python3.7/dist-packages/flask/app.py", line 1744, in handle_http_exception
May  3 00:17:41 debian10 easywall-web[450]:     return handler(e)
May  3 00:17:41 debian10 easywall-web[450]:   File "easywall/web/__main__.py", line 181, in page_not_found_route
May  3 00:17:41 debian10 easywall-web[450]:     return page_not_found(error)
May  3 00:17:41 debian10 easywall-web[450]:   File "./easywall/web/error.py", line 18, in page_not_found
May  3 00:17:41 debian10 easywall-web[450]:     return login()
May  3 00:17:41 debian10 easywall-web[450]:   File "./easywall/web/login.py", line 21, in login
May  3 00:17:41 debian10 easywall-web[450]:     utils.update_last_commit_infos()
May  3 00:17:41 debian10 easywall-web[450]:   File "./easywall/web/webutils.py", line 117, in update_last_commit_infos
May  3 00:17:41 debian10 easywall-web[450]:     commit = self.get_latest_commit()
May  3 00:17:41 debian10 easywall-web[450]:   File "./easywall/web/webutils.py", line 140, in get_latest_commit
May  3 00:17:41 debian10 easywall-web[450]:     response = urllib.request.urlopen(req)
May  3 00:17:41 debian10 easywall-web[450]:   File "/usr/lib/python3.7/urllib/request.py", line 222, in urlopen
May  3 00:17:41 debian10 easywall-web[450]:     return opener.open(url, data, timeout)
May  3 00:17:41 debian10 easywall-web[450]:   File "/usr/lib/python3.7/urllib/request.py", line 525, in open
May  3 00:17:41 debian10 easywall-web[450]:     response = self._open(req, data)
May  3 00:17:41 debian10 easywall-web[450]:   File "/usr/lib/python3.7/urllib/request.py", line 543, in _open
May  3 00:17:41 debian10 easywall-web[450]:     '_open', req)
May  3 00:17:41 debian10 easywall-web[450]:   File "/usr/lib/python3.7/urllib/request.py", line 503, in _call_chain
May  3 00:17:41 debian10 easywall-web[450]:     result = func(*args)
May  3 00:17:41 debian10 easywall-web[450]:   File "/usr/lib/python3.7/urllib/request.py", line 1367, in https_open
May  3 00:17:41 debian10 easywall-web[450]:     context=self._context, check_hostname=self._check_hostname)
May  3 00:17:41 debian10 easywall-web[450]:   File "/usr/lib/python3.7/urllib/request.py", line 1326, in do_open
May  3 00:17:41 debian10 easywall-web[450]:     raise URLError(err)
May  3 00:17:41 debian10 easywall-web[450]: urllib.error.URLError: <urlopen error [Errno -3] Temporary failure in name resolution>
May  3 00:17:41 debian10 easywall-web[450]: [pid: 571|app: 0|req: 12/13] 10.255.242.4 () {48 vars in 877 bytes} [Mon May  3 00:17:01 2021] GET /favicon.ico => generated 290 bytes in 40243 msecs (HTTP/1.1 500) 12 headers in 605 bytes (4 switches on core 0)

Split Warning

Hi there!
I am a little bit unhappy with the easywall project at the moment. I think it was a bad idea to keep easywall and easywall-web together like this. In the next days I want to split the repositories.
In the last few months I learned a lof of python programming and since then I am also unhappy with the code. There is a lot of work to do to clean this up and get some logging and error handling.

failed to install via apt

```root@ubuntu-docker:~#` lsb_release -a

No LSB modules are available.

Distributor ID: Ubuntu

Description: Ubuntu 20.04.2 LTS

Release: 20.04

Codename: focal

root@ubuntu-docker:~# echo "deb https://apt.wdkro.de/ stable main" > /etc/apt/sources.list.d/easywall.list

root@ubuntu-docker:~# apt-key adv --keyserver keyserver.ubuntu.com --recv-keys D88D7689C1624EE3

Executing: /tmp/apt-key-gpghome.AHAOvUxueO/gpg.1.sh --keyserver keyserver.ubuntu.com --recv-keys D88D7689C1624EE3

gpg: keyserver receive failed: No such file or directory```

setup on raspberry

Hi,
I am trying to install easywall on a raspi4.
I was able to fix some dependency issues and everything installed.
the only problem that I have is that I am not able to start the webgui. sudo service easystart-web returns the following error

un 18 01:14:24 nix-gateway-2 systemd[1]: Started easywall-web - web interface to control the easywall core application..
Jun 18 01:14:24 nix-gateway-2 easywall-web[14937]: [uWSGI] getting INI configuration from config/web.ini
Jun 18 01:14:24 nix-gateway-2 easywall-web[14937]: open("./python3_plugin.so"): No such file or directory [core/utils.c line 3732]
Jun 18 01:14:24 nix-gateway-2 easywall-web[14937]: !!! UNABLE to load uWSGI plugin: ./python3_plugin.so: cannot open shared object file: No such file or directory !!!
Jun 18 01:14:24 nix-gateway-2 easywall-web[14937]: unable to load plugin "python3"
Jun 18 01:14:24 nix-gateway-2 systemd[1]: easywall-web.service: Main process exited, code=exited, status=1/FAILURE
Jun 18 01:14:24 nix-gateway-2 systemd[1]: easywall-web.service: Failed with result 'exit-code'.

is there any workaround?
thanks!
Lelio

Missing ".version" file

Hi there.
First of all thanks for all your hard work on this nice piece of software!

I've installed easywall on an ArchlinuxArm system (a Raspberrypi 4). I came across this error on first run:

Traceback (most recent call last):
  File "/usr/lib/python3.9/site-packages/flask/app.py", line 2447, in wsgi_app
    response = self.full_dispatch_request()
  File "/usr/lib/python3.9/site-packages/flask/app.py", line 1952, in full_dispatch_request
    rv = self.handle_user_exception(e)
  File "/usr/lib/python3.9/site-packages/flask/app.py", line 1816, in handle_user_exception
    return self.handle_http_exception(e)
  File "/usr/lib/python3.9/site-packages/flask/app.py", line 1744, in handle_http_exception
    return handler(e)
  File "easywall/web/__main__.py", line 181, in page_not_found_route
    return page_not_found(error)
  File "./easywall/web/error.py", line 18, in page_not_found
    return login()
  File "./easywall/web/login.py", line 22, in login
    payload = utils.get_default_payload("Signin", "signin")
  File "./easywall/web/webutils.py", line 53, in get_default_payload
    payload.current_version = file_get_contents(".version")
  File "./easywall/utility.py", line 54, in file_get_contents
    with open(filepath) as filehandler:
FileNotFoundError: [Errno 2] No such file or directory: '.version'

Doing this fixed it:

echo "0.3.0" > "/usr/share/webapps/easywall/.version"
chown easywall:easywall "/usr/share/webapps/easywall/.version"

My installation uses the install-core and install-web scripts provided (with modifications). Not sure when the .version file is supposed to be created but it seems like it wasn't.
All the best,
Mark.

Feature Request: Easywall meets OpenSnitch ?!

makes no sense, sry

support ARM64

please add support of arm64 architecture

Internal Server Error

when I try to open http://192.168.X.XXX:12227 I have "Internal Server Error" its a german ip

no workin ubuntu 16

Implement description to IP in lists

Hello, please implement the ability to description on each added address in a white or black lists (by analogy as it is done in Port description (optional))
Thanks!

cant reach after install

Hi,
i installed easywall but i cant reach it through the browser.

XXXXXXXX@XXXXXXXX:/usr/local/easywall# python3 core/easywall.py
[2019-08-31 16:12:42,857] [INFO] [easywall.py:178] Starting up EasyWall...
[2019-08-31 16:12:42,859] [INFO] [easywall.py:186] EasyWall is up and running.

cant reach it through 1551 and port 12227

Internal Server Error

I installed Easywall by APT Package Manager and all are success but when I try to open http://myIP:12227 I have "Internal Server Error"
Could you please help me ?

Discord Link in EasyWall is Invalid

Heho.
The Discord link on the EasyWall startpage is invalid.

Demo Server fixed and Life Update

Hi all!
Thank you for adding so many stars over the last few months. I appreciate the interest into this project.
Today I noticed, that the demo system was offline and figured out that I had some SSL certificate issues. This is fixed now and the demo is working again.
Since I moved in March this year I had some trouble working on the project since then. The project will be continued as soon as possible since I am close to the first "kind of stable" release.
Currently I can not use my own software, since this is too instable which makes me mad sometimes.
If you want to support me you can always use the "sponsor" button at the top.
Every Euro will be spent in programming time.

wget error

On some version of wget, for me is wget.x86_64 from mirrors.163.com in centos7, install-web.sh will crash because of the wrong option '--show-progress'.

An easy way to work it out is,

1. vim install-web.sh
2. remove option --show-progress after every wget command lines

how to reach easywall after install

how to reach easywall after install

DEV Streams

Hi there!
Since the project got more popular in the last weeks and I had some time to work on it I want to work on it again this afternoon.
At 7pm german time (UTC+1) I will stream the work on this project.
If you have some spare-time and you are interested in programming you can watch the stream on this URL:
https://www.twitch.tv/kermit6n

Change Authentication

How do I change username or password?

ubuntu 14

EasyWall not work on ubuntu 14 because you cant install python3-watchdog

Traceback (most recent call last):
File "core/easywall.py", line 9, in
from watchdog.observers import Observer
ImportError: No module named 'watchdog'

any solution ?

backup restore

hello, how can i restore backup from backup files?

Backup / Transform configs

Hi there,

thank you for such amazing program,

can you please add a feature to backup the current configurations, including all the blocked ips and so on to a file that will be possible to import such as in pihole?
so we can move them from one operating system to another instead of to reconfigure everything?

and till this feature will be available if at all, can you please advise me how to do it at the moment?

thank you!

can I import iptable rules

it would be lovely if it can backup existing iptable rules and directly import export iptable rules?

How to support CentOS

When can CentOS be supported?

Need to solve an issue between easywall and Matrix on the same host

spantaleev/matrix-docker-ansible-deploy#2456

I've explained everything there ^
Can you please take a look and tell me what you think? No one replied to me so I'm kinda lost on this.

Thanks

First Run does not save the credentials

Heho.
I installed EasyWall some minutes ago and I can't set the login credentials via Webinterface.
If I press the Submit button (forgot button name) my browser throws the error "Connection Reset"
After a page reload the first setup shows again.

I used the command line tool now to create my first login.

EDIT: Same with login: I get "Connection Reset"
EDIT2: There are no errors in the log and It doesn't seem to be a problem with special signs in password.
EDIT3: Changed BindIP in web.ini from 127.0.0.1 to 0.0.0.0 - No change

6 css/js components missing in web/static/css(js).

I cannot get the css(js) file of bootstrap, jquery, etc.

Port Forwarding format?

I was looking around in your documentation (But I couldn't find anything) and trying out the UI, too figure out what the format of the port forwarding is supposed to be.
For example, if I wanted to forward port 80 from IP 192.168.0.100 to port 80 on IP 10.10.10.100 how would that be formatted?

I tried inputting
Local port: 192.168.0.100:80
Remote port: 10.10.10.100:80

That seemed to break the page and make me unable to remove the entry.

Docker Support

Many thanks for the great support since 2019! The community is growing steadily and I hope that some, few people or companies already use the software.
It's great to see the community growing and the Likes increasing.

adapted CentOS

I've adapted CentOS,Can I submit the code?

Internal Server Error / no python application found

Hey, thank you for sharing your project, but could you help me out here?

When I access my WebGUI I get the Internal Server error. Easywall Log is clean, Syslog says me "no python application found". Python3 is installed.

Login for first start

Hi all,
i did not find anything in documentation.
how to login in for the first time ?
i dont have username/pass and editing /opt/easywall/config/web.ini does not lead anywhere
any help or link to something i did not find/see ?
regards
wsx

EDIT: you spend lots of time in great work (like i could see in the demo-version), but if you want your project to become spreade you should at least edit the installation manual to show waht do do after apt install.

EDIT2: i tried to set user and password in web.ini with:
plain pass
sha-1 hash
sha-256 hash
md5 hash
php password_hash
i give up ;(

EDIT3: okay, im in. (the easy way ;))

in /opt/easywall/easywall/web/login.py i altered lines 42 and 43 to one line:
"WEB", "username"):
After login in by user only i generated a password on the webif, logged out and restored the old login.py
Now logging in works fine.
Im not pretty sure if this is the way you have to find out to use this software, but at least it worked ;)

wsx
PS: maybe it would be handy, if easywall would accept a plain pass on first start to salt it itself