Project

puffy

0.0
The project is in a healthy, maintained state
Network firewall rules made easy!
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
 Dependencies

Development

Runtime

 Project Readme

Puffy

Build Status Maintainability Test Coverage Inline docs

Features

  • Generate rules for Netfilter and PF (extensible);
  • IPv6 and IPv4 support;
  • Define the configuration of multiple nodes in a single file;
  • Define services as group of rules to mix-in in nodes rules definitions;
  • Handle NAT & port redirection;

Requirements

  • Accurate DNS information;

Syntax

The Puffy syntax is inspired by the syntax of the OpenBSD Packet Filter, with the ability to group rules in reusable blocks in order to describe all rules of a network of nodes in a single file.

Rules must appear in either a node or service definition, services being reusable blocks of related rules:

service ntp do
  pass proto udp to port ntp
end

service postgresql do
  pass proto tcp to port postgresql
end

service ssh do
  pass proto tcp to port ssh
end

service www do
  pass proto tcp to port {http https}
end

service base do
  client ntp
  server ssh
end

node 'db.example.com' do
  service base
  server postgresql from 'www1.example.com'
end

node /www\d+.example.com/ do
  service base
  server www
  client postgresql to 'db.example.com'
  pass in proto tcp from any to port 8000
end