Skip to main content
emisar

Firewall and netfilter

v0.1.8

iptables, nftables, conntrack, and traffic-control inspection plus narrow operator actions for incident response (block IP, unblock IP, flush chain). Rule edits are not persisted across iptables service reload — use IaC for permanent rules.

8 allowed by default 2 need approval by default 1 denied by default
Pack ID
firewall
Vendor
emisar
OS
linux
Actions
11
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
iptables

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install firewall --hash sha256:db2315943b75a79da7212ffe29b523728ef13a1ebf12ab40b4aba91f1d615cfe

Actions 11 total

View on GitHub
  • fw.conntrack_count exec low

    conntrack count

    Show active connection-tracking entry count + per-state breakdown.

    View source on GitHub
  • fw.conntrack_list exec low

    conntrack -L (capped)

    List the first 1000 connection-tracking entries. Use to see what's NAT'd right now.

    View source on GitHub
  • fw.ip_rule_show exec low

    ip rule show

    Show policy routing rules — which routing table is used for which traffic.

    View source on GitHub
  • fw.iptables_block_ip exec high

    iptables -I INPUT -s <ip> -j DROP

    Insert a DROP rule for one source IP at the top of the INPUT chain. Use during an active incident to immediately block a known-bad source. Rule is not persistent — survives only until iptables service reload or reboot. Combine with iptables-save to persist.

    View source on GitHub
  • fw.iptables_filter exec low

    iptables -L -nv (filter table)

    List all filter-table rules with packet + byte counters.

    View source on GitHub
  • fw.iptables_flush_chain exec critical

    iptables -F <chain>

    Flush all rules from a single chain. ALL rules in that chain are removed; default policy still applies. INPUT/FORWARD with a DROP default plus a flushed chain means ALL traffic is dropped — only use during planned firewall rebuilds with console access ready.

    View source on GitHub
  • fw.iptables_mangle exec low

    iptables -L -nv (mangle table)

    List all mangle-table rules — QoS marks, TTL tweaks.

    View source on GitHub
  • fw.iptables_nat exec low

    iptables -L -nv (nat table)

    List all nat-table rules — DNAT/SNAT/MASQUERADE.

    View source on GitHub
  • fw.iptables_unblock_ip exec high

    iptables -D INPUT -s <ip> -j DROP

    Remove a previously-inserted DROP rule for one IP. Use to undo a manual block. Matches the rule by literal -s/-j signature; if the rule isn't found, iptables errors and nothing changes.

    View source on GitHub
  • fw.nft_list_ruleset exec low

    nft list ruleset

    Show the full nftables ruleset across all families.

    View source on GitHub
  • fw.tc_qdisc_show exec low

    tc -s qdisc show

    List active traffic-control disciplines per interface + their counters. Use to see traffic shaping in effect.

    View source on GitHub
← Back to registry
Pack reference Publish your own →