Firewall and netfilter

v0.1.6

iptables, nftables, conntrack, and traffic-control inspection plus narrow operator actions for incident response (block IP, unblock IP, flush chain). Rule edits are not persisted across iptables service reload — use IaC for permanent rules.

8 allowed by default 2 need approval 1 denied by default

Pack ID

firewall

Vendor

emisar

linux

Actions

Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.


              iptables

Install

emisar pack install validates the pack and verifies its content hash before copying it into /etc/emisar/packs. The --hash below pins the install to the exact bytes on this page — a tampered copy is rejected. After install, reload the runner; it re-reads the catalog and advertises every action.

content hash: sha256:438f96c9711cc49487224cec7ba9210b38a9b9a5e7b849c72528f3507a02b6cb

on the runner host

sudo emisar pack install firewall \
  --hash sha256:438f96c9711cc49487224cec7ba9210b38a9b9a5e7b849c72528f3507a02b6cb \
  --dest /etc/emisar/packs

# Reload so the runner re-reads the catalog:
sudo systemctl reload emisar

Actions 11 total

View on GitHub

fw.conntrack_count exec low

conntrack count
fw.conntrack_list exec low

conntrack -L (capped)
fw.ip_rule_show exec low

ip rule show
fw.iptables_block_ip exec high

iptables -I INPUT -s <ip> -j DROP
fw.iptables_filter exec low

iptables -L -nv (filter table)
fw.iptables_flush_chain exec critical

iptables -F <chain>
fw.iptables_mangle exec low

iptables -L -nv (mangle table)
fw.iptables_nat exec low

iptables -L -nv (nat table)
fw.iptables_unblock_ip exec high

iptables -D INPUT -s <ip> -j DROP
fw.nft_list_ruleset exec low

nft list ruleset
fw.tc_qdisc_show exec low

tc -s qdisc show

← Back to registry

Pack reference Publish your own →