Firegex is a firewall that includes different functionalities, created for CTF Attack-Defense competitions that has the aim to limit or totally deny malicious traffic through the use of different kind of filters.
If Docker is not available or you're running in a rootless environment, Firegex can run in standalone mode:
```bash
# Automatic detection (fallback to standalone if Docker unavailable)
python3 start.py start
# Force standalone mode
python3 start.py start --standalone
# Check status
python3 start.py status
# Stop standalone mode
python3 start.py stop
```
Standalone mode automatically:
- Downloads pre-built rootfs from GitHub releases
- Detects your architecture (amd64/arm64)
- Sets up chroot environment with necessary bind mounts
- Runs as a background daemon process
- Manages PID files for process control
If the server is restarted, docker mode will automatically restart the service, while standalone mode will require you to run the start command again manually.
- Regex filtering using [NFQUEUE](https://netfilter.org/projects/libnetfilter_queue/) with [nftables](https://netfilter.org/projects/nftables/) uses a c++ file that handle the regexes and the requests, blocking the malicius requests. PCRE2 regexes are used. The requests are intercepted kernel side, so this filter works immediatly (IPv4/6 and TCP/UDP supported)
- Create basic firewall rules to allow and deny specific traffic, like ufw or iptables but using firegex graphic interface (by using [nftable](https://netfilter.org/projects/nftables/))
- Port Hijacking allows you to redirect the traffic on a specific port to another port. Thanks to this you can start your own proxy, connecting to the real service using the loopback interface. Firegex will be resposable about the routing of the packets using internally [nftables](https://netfilter.org/projects/nftables/)
- EXPERIMENTAL: Netfilter Proxy uses [nfqueue](https://netfilter.org/projects/libnetfilter_queue/) to simulate a python proxy, you can write your own filter in python and use it to filter the traffic. There are built-in some data handler to parse protocols like HTTP, and before apply the filter you can test it with fgex command (you need to install firegex lib from pypi).
The default and recommended deployment method using Docker containers. Provides complete isolation and easy management.
### Standalone Mode
When Docker is not available or when running in environments where Docker cannot be used (e.g., rootless containers, restricted environments), Firegex can run in standalone mode.
**How Standalone Mode Works:**
1.**Automatic Detection**: If Docker is unavailable or in rootless mode, standalone mode is automatically enabled
2.**Rootfs Download**: Downloads pre-built filesystem archives from GitHub releases based on your architecture
3.**Chroot Environment**: Creates an isolated chroot environment with necessary system mounts
4.**Daemon Process**: Runs as a background daemon with PID management
5.**Process Control**: Provides start/stop/status commands for service management
**Standalone Mode Commands:**
```bash
# Start (automatically detects if standalone needed)
python3 start.py start
# Force standalone mode
python3 start.py --standalone start
# Check if running
python3 start.py status
# Stop the service
python3 start.py stop
# Clean up rootfs (removes downloaded files)
python3 start.py --clear-standalone
```
**Technical Details:**
- Downloads `firegex-rootfs-{arch}.tar.gz` from latest GitHub release
- Creates chroot environment in `~/.firegex/rootfs/`
- Bind mounts `/dev`, `/proc`, and network configuration files
- Manages daemon process with PID file in `~/.firegex/firegex.pid`
- Automatically handles privilege escalation using sudo when needed
More specific information about how Firegex works, and in particular about the nfproxy module, are available here (in italian only): [https://github.com/domysh/engineering-thesis](https://github.com/domysh/engineering-thesis) (PDF in the release attachments)
This means that firegex is projected to avoid any possibility to have the service down. We know that passing all the traffic through firegex, means also that if it fails, all services go down. It's for this that firegex implements different logics to avoid this. Also, if you add a wrong filter to your services, firegex will always offer you a fast or instant way to reset it to the previous state.
Initiially the project was based only on regex filters, and also now the main function uses regexes, but firegex have and will have also other filtering tools.
