114 lines
3.4 KiB
Markdown
114 lines
3.4 KiB
Markdown
|
|
|
|
# fwlnx
|
|
|
|
Firewall Linux - A small and simple Linux based Firewall Distribution
|
|
|
|
It combines a standard Linux distribution with modern network services, a simple web interface and API to configure it. It's not meant to be a replacement to far superiour Appliances like pfSense or OPNSense but as an alternative solution for typical home use.
|
|
|
|
## Target platforms
|
|
|
|
- QEMU/KVM
|
|
- [PCEngines APU2/3/4](https://www.pcengines.ch/apu2.htm)
|
|
- Generic [AliExpress](https://www.aliexpress.com/wholesale?catId=0&SearchText=router+pc) Router PCs
|
|
|
|
## Planned initial features
|
|
|
|
- Firewall
|
|
- [ ] NAT
|
|
- [ ] Rules
|
|
- [ ] UPnP
|
|
- [ ] DynDNS
|
|
- VPN
|
|
- [ ] [OpenVPN](https://openvpn.net/)
|
|
- [ ] [Wireguard](https://www.wireguard.com/)
|
|
- [ ] NTP ([chrony](https://chrony.tuxfamily.org/))
|
|
- [ ] DHCP ([Kea](https://www.isc.org/kea/))
|
|
- [ ] DNS ([Knot](https://www.knot-dns.cz/))
|
|
- [ ] Auto config backup
|
|
- [ ] Cron/Timers ([Systemd-timers](https://www.freedesktop.org/software/systemd/man/systemd.timer.html))
|
|
|
|
## Installation
|
|
|
|
TBD
|
|
|
|
## Design
|
|
|
|
### Partitioning
|
|
|
|
The partitioning schema is kept simple and will be setup like this:
|
|
|
|
BIOS/MBR:
|
|
|
|
```
|
|
/dev/sda:
|
|
/dev/sda1 swap [SWAP] # SWAP
|
|
/dev/sda2 ext4 / # FWLNX
|
|
```
|
|
|
|
UEFI/GPT:
|
|
|
|
```
|
|
/dev/sda:
|
|
/dev/sda1 vfat /boot # ESP
|
|
/dev/sda2 swap [SWAP] # SWAP
|
|
/dev/sda3 ext4 / # FWLNX
|
|
```
|
|
|
|
### Operating system
|
|
|
|
As the base operatring system NixOS is used.
|
|
|
|
### [Garmr](https://gitlab.com/fwlnx/garmr)
|
|
|
|
Backend daemon
|
|
|
|
### [Freyja](https://gitlab.com/fwlnx/freyja)
|
|
|
|
Web frontend
|
|
|
|
# OLD concept
|
|
|
|
### ~Update flow~
|
|
|
|
~State before the update:~
|
|
|
|
- ~boot entry `last` is set to version 1 (last known working version)~
|
|
- ~boot entry `current` is also set to version 1~
|
|
- ~on every boot the default boot entry is set to `last` automatically in early boot~
|
|
|
|
~Update process:~
|
|
|
|
- ~a new version is downloaded as a btrfs snapshot and put into place as version 2~
|
|
- ~`current` boot entry is modified to boot the new version~
|
|
- ~`current` is set as default boot entry~
|
|
|
|
- ~device reboots into new version 2 via `current` boot entry~
|
|
- ~early boot sets `last` as default boot entry~
|
|
- ~after successful boot:~
|
|
- ~the user marks the system as functional which sets the `last` boot entry to the current version~
|
|
- ~if something goes wrong:~
|
|
- ~the system reboots, now with the `last` entry being the default booting into the last known working system~
|
|
- ~the user gets displayed an error because `last` and `current` is not the pointing to the same version and `last` is booted indicating an error~
|
|
|
|
### ~Configuration changes~
|
|
|
|
- ~User changes current config via HTTP API (Web interface)~
|
|
- ~Background process puts changes into ansible variables in `/config`~
|
|
- ~When user discards changes git repo under `/config` is reset to original state~
|
|
- ~When change is ready and user triggers commit via HTTP API~
|
|
- ~Changes form a git commit with name `[$VERSION] $username - $change summary`~
|
|
- ~Timer is setup to revert to old config in 600s~
|
|
- ~Changes get applied via ansible~
|
|
- ~User confirms working state via HTTP API~
|
|
- ~Timer get removed~
|
|
- ~If new change is not confirmed and Timer gets triggered~
|
|
- ~git commit is reverted~
|
|
- ~Ansible runs again with old config~
|
|
- ~User get an error message~
|
|
|
|
---
|
|
|
|
Made with ❤️ and 🪄✨.
|
|
|
|
Icon partly from [stockio](https://www.stockio.com/free-icon/nature-icons-penguin)
|