Skip to main content
emisar

Firewall and netfilter

v0.1.17

iptables, nftables, conntrack, and traffic-control inspection plus narrow operator actions for incident response (block IP, unblock IP, flush chain). Rule edits are not persisted across iptables service reload — use IaC for permanent rules.

10 allowed by default 2 need approval by default 1 denied by default
Pack ID
firewall
Vendor
emisar
OS
linux
Actions
13
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
iptables jq nft tc

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install firewall --hash sha256:81d84b4ed172cfbd457dba9f752cc9d7f0045cda1c4895a4873b036e2fa17157

Setup

Operates on the local runner host — no credentials needed.

Host access

Run these commands yourself on the runner host. Emisar shows and copies setup recipes; it never runs them.

Inspect and change the host network namespace with CAP_NET_ADMIN.

fw.iptables_filterfw.iptables_natfw.iptables_manglefw.nft_list_rulesetfw.conntrack_countfw.conntrack_listfw.iptables_block_ipfw.iptables_unblock_ipfw.iptables_flush_chainfw.nft_list_chainfw.nft_port_rules

Grant CAP_NET_ADMIN to the Emisar service

Grant access 
sudo install -d -m 0755 /etc/systemd/system/emisar.service.d
printf '%s\n' '[Service]' 'AmbientCapabilities=CAP_NET_ADMIN' | sudo tee /etc/systemd/system/emisar.service.d/10-firewall-host-access.conf >/dev/null
sudo systemctl daemon-reload
sudo systemctl restart emisar
Verify access 
systemctl show emisar --property=AmbientCapabilities --value | grep -Fwi cap_net_admin

Impact: Every Emisar action on this runner inherits CAP_NET_ADMIN and can change routes, firewall rules, traffic control, and other network state in the host namespace.

Verify it works

Runs fw.conntrack_count, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify firewall

Install and configure a pack walks through the whole sequence on a host.

Actions 13 total

View on GitHub
  • fw.conntrack_count exec low Low — read-only or trivially reversible

    conntrack count

    Show active connection-tracking entry count + per-state breakdown.

    View source on GitHub
  • fw.conntrack_list exec low Low — read-only or trivially reversible

    conntrack -L (capped)

    List the first 1000 connection-tracking entries. Use to see what's NAT'd right now.

    View source on GitHub
  • fw.ip_rule_show exec low Low — read-only or trivially reversible

    ip rule show

    Show policy routing rules — which routing table is used for which traffic.

    View source on GitHub
  • fw.iptables_block_ip exec high High — service-affecting

    iptables -I INPUT -s <ip> -j DROP

    Insert a DROP rule for one source IP at the top of the INPUT chain. Use during an active incident to immediately block a known-bad source. Rule is not persistent — survives only until iptables service reload or reboot. Combine with iptables-save to persist.

    View source on GitHub
  • fw.iptables_filter exec low Low — read-only or trivially reversible

    iptables -L -nv (filter table)

    List all filter-table rules with packet + byte counters.

    View source on GitHub
  • fw.iptables_flush_chain exec critical Critical — data loss or irreversible

    iptables -F <chain>

    Flush all rules from a single chain. ALL rules in that chain are removed; default policy still applies. INPUT/FORWARD with a DROP default plus a flushed chain means ALL traffic is dropped — only use during planned firewall rebuilds with console access ready.

    View source on GitHub
  • fw.iptables_mangle exec low Low — read-only or trivially reversible

    iptables -L -nv (mangle table)

    List all mangle-table rules — QoS marks, TTL tweaks.

    View source on GitHub
  • fw.iptables_nat exec low Low — read-only or trivially reversible

    iptables -L -nv (nat table)

    List all nat-table rules — DNAT/SNAT/MASQUERADE.

    View source on GitHub
  • fw.iptables_unblock_ip exec high High — service-affecting

    iptables -D INPUT -s <ip> -j DROP

    Remove a previously-inserted DROP rule for one IP. Use to undo a manual block. Matches the rule by literal -s/-j signature; if the rule isn't found, iptables errors and nothing changes.

    View source on GitHub
  • fw.nft_list_chain exec low Low — read-only or trivially reversible

    List one nftables chain as JSON

    Return native nftables JSON for one exact chain, including rule handles and numeric protocol and port values.

    View source on GitHub
  • fw.nft_list_ruleset exec low Low — read-only or trivially reversible

    nft list ruleset

    Show the full nftables ruleset across all families.

    View source on GitHub
  • fw.nft_port_rules script low Low — read-only or trivially reversible

    Project nftables rules for one port

    Project rules with direct source or destination port expressions for one numeric port. Rules that reference named sets, maps, or unsupported expressions are returned separately as unresolved. This is inspection evidence, not an effective allow or deny decision: chain order, jumps, policies, and other predicates still apply.

    View source on GitHub
  • fw.tc_qdisc_show exec low Low — read-only or trivially reversible

    tc -s qdisc show

    List active traffic-control disciplines per interface + their counters. Use to see traffic shaping in effect.

    View source on GitHub
← Back to registry
Pack reference  Publish your own