denozord/EvoFirewall

Fork 0

Files

T

Denozordec 43f5ac2525

Build and Push EvoFirewall Docker Image / build-and-push (push) Successful in 1m43s

Details

Build and Push EvoFirewall Docker Image / create-release (push) Skipped

Details

feat(api, web): implement port ACL and host firewall snapshot features

- Added support for managing desired L4 port ACL rules for Linux agents, allowing for open/close actions on specified ports.
- Introduced a new endpoint for CRUD operations on port rules, enhancing the API's capabilities for agent management.
- Implemented functionality to collect and report host firewall snapshots, capturing observed rules and listeners for better monitoring.
- Updated the agent detail view to include tabs for managing port ACLs and viewing host firewall data, improving user experience.
- Enhanced documentation to reflect the new features and API changes, ensuring clarity for users and developers.

These changes significantly improve the management and visibility of firewall rules and port access control for agents.

2026-08-11 15:08:00 +07:00

2.1 KiB

Raw Blame History

Архитектура EvoFirewall

Централизованный control plane для firewall-агентов (Linux nft/ipset, MikroTik address-list).

Компоненты

Компонент	Путь	Роль
Web SPA	`apps/web`	ReUI Frame, TanStack Router/Query
API	`apps/api`	Fastify 5, JWT + agent tokens
DB	`packages/db`	Drizzle + SQLite WAL
Shared	`packages/shared`	Zod-контракты, RBAC helpers
UI	`packages/ui`	shadcn primitives `@evofw/ui`
Agents	`apps/api/src/agent-scripts`	install.sh, sync, MikroTik RSC

Потоки

Enroll — POST /v1/agent/enroll + X-EvoFW-Seed → pending agent
Approve — UI/API → status approved
Policy — GET /v1/agent/policy → deny/allow CIDRs + default_action + optional port_rules + hash (apply_version: 3)
Apply — agent пишет kernel rules (L3 + L4 port ACL на nft), POST /v1/agent/apply-report + stats + optional host_firewall snapshot
Lists refresh — cron каждые 5 мин (json_url / domains / evobgp_community)

Политика

Именованные наборы правил (policy_sets); агенту назначается M:N через agent_policy_sets
Правило в наборе: action: deny | allow + ровно один источник — IP-список (list_id), CIDR или DNS-имя (hostname → A/AAAA, кэш в policy_rule_resolved)
Evaluate: правила всех назначенных enabled-наборов (sort + priority) + ip_overrides
Цепочка ядра всегда: deny → allow → default_action (accept | drop на агенте)
На Linux nft: после allow — Port ACL (close drop, затем open accept) из agent_port_rules
Exact overlap: allow \ deny (conflicts_dropped); deny wins
Overrides, смена наборов, default_action, Port ACL и refresh DNS/lists бампят policy_generation

Auth

Portal SSO app id fw, permissions fw:*
Agent bearer token (sha256 hash в БД)

2.1 KiB Raw Blame History