Firewall¶

Overview¶

The Firewall module manages exactly one nftables table — table inet monsterops — as a host input filter. It never reads or writes any other nftables table you already run. You build rules (with RADIUS-aware presets), keep named sets/blocklists, preview the exact .nft and a diff against the live ruleset, then Apply with a snapshot and an auto-rollback timer.

Read this before you Apply

Because it filters traffic to this server, and that includes RADIUS, two things catch people out — and they're the reason the safeguards exist:

A block can silently stop a NAS. A block drops the matching source in the kernel before FreeRADIUS ever sees the packet. Block an IP a NAS authenticates from and that NAS's auth and accounting simply stop — no error, the packet never arrives.
A block can lock you out. Blocking the address you administer from, or switching to deny-by-default, can cut off your own SSH and the web UI.

Where things are¶

Rules — the staged ruleset, with per-rule counters once applied. RADIUS presets speed up common rules.
Sets / blocklists — named sets you can add to and remove from live (ban sets, country blocks).
Preview — the exact .nft that will load, and a diff against the live ruleset. Nothing is applied until you press Apply.
Auto-block activity — the audit trail of automatic blocks (source, reason, rule, operator override).

The safeguards¶

Nothing applies until you say so. Every edit is staged; you see the .nft and diff first.
Apply is reversible by default. Apply snapshots the live ruleset, then arms a 60-second commit-confirm. If you don't confirm in the window — e.g. because the change just cut off your own access — it automatically rolls back.
Anti-lockout guards are always emitted. Loopback, established/related connections, the SSH and web-UI ports, and your current admin IP are allowed ahead of any deny rule. Aggressive modes also auto-build a NAS guard set from your nas table so RADIUS keeps flowing.
You're warned before a block bites. Adding to a block set, a one-click country block, or an allow-only switch runs a preflight that checks the target against your current IP, every IP that has logged into MonsterOps, and every configured NAS — and warns you, with the specific addresses. It's CIDR-aware, so a /16 or whole-country range that contains one of those addresses is caught, not just an exact match.

Adaptive access control¶

Brute-force auto-block — after N Access-Rejects from one source in a window, that source is added to a ban set for a configurable duration. It bans by subscriber (Calling-Station-Id), never by a NAS's address.
Country block — one click adds a country's IP ranges to a managed block set.
Country allow-only (inverse block) — "allow only this country, deny everything else." This flips the policy to deny-by-default — the single easiest way to lock yourself out, which is exactly why it auto-provisions the NAS guard set and keeps SSH, the web UI, your admin IP, and established connections reachable.
Blocklist audit trail — every automatic block is recorded and shown in the activity panel and the dashboard widget.

If you get locked out¶

Recover from the host's console or an SSH session as root:

sudo /opt/monsterops/scripts/mr-firewall-panic.sh
# …or the one-liner it runs:
sudo nft delete table inet monsterops

This removes only table inet monsterops and its boot-restore file, restoring connectivity immediately without touching any other table. Input filtering stays off until you Apply again — fix the offending rule or allow-only setting first.

Problems you may hit¶

A NAS stopped authenticating after I applied rules

A block is dropping that NAS's packets before FreeRADIUS sees them. Check the block sets against the NAS's source IP; the preflight warns about this, but a rule added another way can still bite. Remove the offending entry and re-Apply.

The page "rolled back" my change — you didn't confirm within 60 seconds, usually because the change cut your own access. That's the safety net working; fix the rule and try again.
nftables not installed banner — you can build and preview rules but not apply them; install nftables (see Requirements).

NAS — the guard set is built from your NAS entries
Automation — the firewall_ban action
Configuration — MONSTEROPS_FIREWALL_RULESET_PATH