fwlnx

Firewall Linux - A small and simple Busybox/Linux Firewall Distribution

It combines an optimized Linux Kernel, Busybox and a simple Webinterface and API to configure. It is not meant to be a replacement to far superiour Appliances but as an alternative solution for typical home use.

Target platforms

QEMU/KVM
PCEngines APU2

Planned initial features

Firewall
- NAT
- Rules
- UPnP
DynDNS
VPN
- OpenVPN
- Wireguard
NTP
DHCP
DNS
Auto config backup
Cron/Timers

Design

Partitioning

MBR/BIOS:

/dev/disk:
  /dev/disk1  ext4                   /boot
  /dev/disk2  swap                   [SWAP]
  /dev/disk3  btrfs@home             /home
  /dev/disk3  btrfs@config           /config
  /dev/disk3  btrfs@root-2021-04-01  /
  /dev/disk3  btrfs@root-2021-04-20  /

Every installed release has it's own subvolume for the rootfs
The config subvolumes has a git repository which saves all configuration changes and the used version
The user can choose which one to boot into

Update flow

State before the update:

boot entry last is set to version 1 (last known working version)
boot entry current is also set to version 1
on every boot the default boot entry is set to last automatically in early boot

Update process:

a new version is downloaded as a btrfs snapshot and put into place as version 2
current boot entry is modified to boot the new version
current is set as default boot entry
device reboots into new version 2 via current boot entry
early boot sets last as default boot entry
after successful boot:
- the user marks the system as functional which sets the last boot entry to the current version
if something goes wrong:
- the system reboots, now with the last entry being the default booting into the last known working system
- the user gets displayed an error because last and current is not the pointing to the same version and last is booted indicating an error

Configuration changes

User changes current config via HTTP API (Web interface)
- Background process puts changes into ansible variables in /config
When user discards changes git repo under /config is reset to original state
When change is ready and user triggers commit via HTTP API
- Changes form a git commit with name [$VERSION] $username - $change summary
- Timer is setup to revert to old config in 600s
- Changes get applied via ansible
User confirms working state via HTTP API
- Timer get removed
If new change is not confirmed and Timer gets triggered
- git commit is reverted
- Ansible runs again with old config
- User get an error message

Made with ❤️ and 🪄✨.

Icon partly from stockio

2.9 KiB Raw Blame History