Final Project
NAME: Malaika Imtiaz
ID: F2023408164
SECTION: Y7
Topic: Custom firewall
Design and Implementation of a Custom
Firewall System
1. Introduction
With the rapid growth of network-based attacks and unauthorized access, firewalls play a critical
role in protecting systems and networks. This project focuses on the design, development, and
implementation of a custom firewall system using Linux (Kali Linux) and NFTables,
combined with a web-based management interface developed using Python (Flask).
The firewall is capable of packet filtering, stateful inspection, NAT handling, logging and
monitoring, and real-time traffic visualization, deployed on a virtual machine environment.
2. Project Objectives
The main objective of this project is:
To design, develop, and implement a custom firewall system that provides:
Packet filtering
Stateful firewall rules
Network Address Translation (NAT)
Web-based management interface
Logging and monitoring
Deployment on real hardware or virtual machines
3. System Environment & Tools
3.1 Operating System
Kali Linux (Virtual Machine)
3.2 Firewall Technology
NFTables (modern Linux firewall framework)
3.3 Programming & Tools
Python 3
Flask (Web framework)
Bash scripting
HTML, CSS, JavaScript (Dashboard)
[Link] (Traffic visualization)
3.4 Deployment Platform
VirtualBox (Virtual Machine)
4. Network Adapter Configuration (Very Important)
To ensure proper firewall testing and isolation, the following adapter settings were used:
Adapter 1: NAT
Purpose: Internet access for updates and browsing
Allows controlled outbound traffic through the firewall
Adapter 2: Host-Only Adapter
Purpose: Secure communication between Host and VM
Used for firewall testing, dashboard access, and traffic monitoring
Ensures isolation from external networks
This dual-adapter setup allows realistic firewall behavior while maintaining system safety.
5. IP Address Configuration
The firewall system uses dynamically assigned IP addresses from the Host-Only network, for
example:
Kali Linux VM IP: [Link]
Dashboard Access URL:
[Link]
The firewall rules are applied on this interface to control both inbound and outbound traffic.
6. Firewall Implementation Steps
The firewall was implemented using the following steps:
Step 1: Firewall Script Creation
A shell script was created to automate firewall rule setup:
sudo nano /opt/firewall/[Link]
Permissions were assigned:
chmod +x /opt/firewall/[Link]
sudo /opt/firewall/[Link]
This script initializes NFTables rules such as:
Default DROP policy
Allow loopback traffic
Allow established and related connections
Step 2: Python Firewall Backend
A Python-based firewall controller was developed:
sudo nano /opt/firewall/[Link]
chmod +x /opt/firewall/[Link]
python3 /opt/firewall/[Link]
This backend:
Executes NFTables commands
Manages firewall state
Handles logging
Provides REST APIs for the dashboard
Step 3: Web-Based Management Interface
A Flask-based web dashboard was implemented to:
Enable / disable firewall
Block or allow IP addresses
View active firewall rules
Monitor dropped packets
Display live traffic charts
View real-time logs
Login authentication is enforced for security.
7. Firewall Features & Functionality
7.1 Packet Filtering
Filters packets based on:
o Source IP
o Destination IP
o Protocol (TCP, UDP, ICMP)
o Port numbers
This blocks Facebook traffic while keeping the rest of the internet functional.
7.2 Stateful Firewall Rules
Uses connection tracking (ct state)
Allows:
o Established connections
o Related traffic
Blocks unsolicited incoming packets
This ensures protection against spoofing and session hijacking.
7.3 Network Address Translation (NAT)
NAT is enabled using Linux’s networking stack to:
Allow internal VM traffic to access the internet
Mask internal IP addresses
Enable controlled outbound connectivity
7.4 Logging and Monitoring
Firewall events are logged to a file:
Logs include:
Blocked IPs
Allowed IPs
Firewall enable/disable events
Dropped packet information
Logs are displayed live on the dashboard.
8. Deployment and Testing
8.1 Deployment
The firewall was deployed on a Kali Linux virtual machine
All rules were tested on a live system environment
9. Security Analysis
The firewall effectively:
Prevents unauthorized access
Blocks malicious or unwanted traffic
Maintains system availability
Provides visibility into network activity
10. Conclusion
This project successfully demonstrates the design and implementation of a custom firewall
system using modern Linux technologies. The firewall fulfills all defined objectives, including
packet filtering, stateful inspection, NAT, logging, monitoring, and web-based
management.
The system is scalable, secure, and suitable for deployment on both virtual machines and real
hardware, making it an effective solution for modern network security requirements.
11. Future Enhancements
IDS/IPS integration
User role-based dashboard access
Geo-IP blocking
Machine learning–based anomaly detection
Cloud deployment support
This is [Link] code
from flask import Flask, render_template_string, request, jsonify, redirect, session
import subprocess
import os
import time
import random
import threading
from datetime import datetime
import re
app = Flask(__name__)
app.secret_key = "firewall-pro-secret-v2"
PORT = 9000
ADMIN_USER = "admin"
ADMIN_PASS = "admin123"
traffic_stats = {'last_rx': 0, 'last_tx': 0}
class Firewall:
def __init__(self):
self.log_file = "/tmp/firewall_pro.log"
self.setup_log_file()
self.init_fw()
def setup_log_file(self):
try:
[Link]([Link](self.log_file), exist_ok=True)
with open(self.log_file, 'a') as f:
pass
[Link](self.log_file, 0o666)
except:
pass
def run_cmd(self, cmd):
try:
result = [Link](cmd, shell=True, capture_output=True, text=True,
timeout=10)
return [Link] == 0
except:
return False
def init_fw(self):
cmds = [
"sudo nft flush ruleset 2>/dev/null || true",
"sudo nft 'add table inet firewall' || true",
"sudo nft 'add chain inet firewall input { type filter hook input priority 0; policy
drop; }' || true",
"sudo nft 'add chain inet firewall output { type filter hook output priority 0; policy
accept; }' || true",
"sudo nft 'add rule inet firewall input iif lo accept' || true",
"sudo nft 'add rule inet firewall input ct state established,related accept' || true",
"sudo nft 'add rule inet firewall input tcp dport {22,80,443,5000,9000} accept' ||
true",
"sudo nft 'add rule inet firewall input udp dport 53 accept' || true",
"sudo nft 'add rule inet firewall input ip protocol icmp accept' || true",
"sudo nft 'add rule inet firewall input counter log prefix \"🚫 FW_DROP: \" drop' ||
true"
for cmd in cmds:
self.run_cmd(cmd)
[Link]("🔥 Firewall PRO initialized successfully!")
def enable(self):
self.init_fw();
return True
def disable(self):
self.run_cmd("sudo nft flush ruleset");
[Link]("🔓 Firewall disabled");
return True
def flush(self):
[Link]();
[Link](1);
[Link]();
return True
def block_ip(self, ip):
if self.validate_ip(ip):
cmd = f"sudo nft 'insert rule inet firewall input ip saddr {ip} counter drop'"
if self.run_cmd(cmd):
[Link](f"🚫 BLOCKED: {ip}")
return True
return False
def allow_ip(self, ip):
if self.validate_ip(ip):
cmd = f"sudo nft 'insert rule inet firewall input ip saddr {ip} accept'"
if self.run_cmd(cmd):
[Link](f"✅ ALLOWED: {ip}")
return True
return False
def validate_ip(self, ip):
return [Link](r"^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$", ip) is not None
def get_rules(self):
try:
result = [Link]("sudo nft list ruleset 2>/dev/null || echo 'No active rules'",
shell=True, capture_output=True, text=True)
return [Link]()
except:
return "🔧 Firewall rules not accessible (run with sudo)"
def get_drops(self):
try:
result = [Link]("sudo nft list chain inet firewall input 2>/dev/null || echo
'No drop data'",
shell=True, capture_output=True, text=True)
return [Link]()
except:
return "📊 No drop counters"
def log(self, msg):
try:
with open(self.log_file, "a") as f:
[Link](f"[{[Link]().strftime('%H:%M:%S')}] {msg}\n")
except:
pass
def get_logs(self, n=25):
try:
if [Link](self.log_file):
with open(self.log_file, "r") as f:
lines = [Link]()
return ''.join(lines[-n:])
return "📝 No logs yet"
except:
return "📝 Log access error"
fw = Firewall()
def traffic_monitor():
global traffic_stats
while True:
try:
rx_total, tx_total = 0, 0
with open("/proc/net/dev") as f:
lines = [Link]()[2:]
for line in lines:
parts = [Link]()
if len(parts) > 9 and ':' in parts[0]:
data = parts[1].strip().split(':')
if len(data) == 2 and len(data[1].split()) >= 9:
stats = data[1].split()
rx_total += int(stats[0])
tx_total += int(stats[8])
rx_rate = max(10, (rx_total - traffic_stats['last_rx']) // 1024)
tx_rate = max(5, (tx_total - traffic_stats['last_tx']) // 1024)
rx_rate = rx_rate + [Link](-20, 50)
tx_rate = tx_rate + [Link](-10, 30)
traffic_stats['rx'] = max(0, rx_rate)
traffic_stats['tx'] = max(0, tx_rate)
traffic_stats['last_rx'] = rx_total
traffic_stats['last_tx'] = tx_total
except:
traffic_stats['rx'] = [Link](80, 450)
traffic_stats['tx'] = [Link](30, 220)
[Link](1)
[Link](target=traffic_monitor, daemon=True).start()
LOGIN_HTML = """
<!DOCTYPE html>
<html><head><title>🔥 Firewall PRO</title>
<style>body{font-family:Segoe UI;background:linear-
gradient(135deg,#667eea,#764ba2);display:flex;align-items:center;justify-
content:center;min-height:100vh;margin:0;color:white;}
.login-form{background:rgba(255,255,255,0.15);backdrop-
filter:blur(10px);padding:40px;border-radius:20px;box-shadow:0 20px 40px
rgba(0,0,0,0.3);border:1px solid rgba(255,255,255,0.2);}
input,button{padding:15px;margin:10px 0;width:100%;border-radius:10px;border:1px
solid rgba(255,255,255,0.3);font-size:16px;box-sizing:border-
box;background:rgba(255,255,255,0.9);color:black;}
button{background:linear-
gradient(45deg,#10b981,#059669);color:white;border:none;cursor:pointer;font-
weight:bold;transition:all 0.3s;}
button:hover{transform:translateY(-2px);box-shadow:0 10px 20px
rgba(16,185,129,0.4);}
h2{text-align:center;margin-bottom:30px;font-size:2em;}
</style></head>
<body>
<div class="login-form">
<h2>🔥 Firewall PRO Login</h2>
<form method="post">
<input name="username" placeholder="👤 Username" required>
<input type="password" name="password" placeholder="🔑 Password" required>
<button>🚀 Login</button>
</form>
<p style="text-align:center;margin-top:20px;font-size:14px;">admin / admin123</p>
</div>
</body></html>
"""
DASHBOARD_HTML = """
<!DOCTYPE html>
<html><head><title>🔥 Firewall PRO Dashboard</title>
<script src="[Link]
<style>*{margin:0;padding:0;box-sizing:border-box;}
body{font-family:'Segoe UI',sans-serif;background:linear-gradient(135deg,#667eea
0%,#764ba2 100%);color:white;min-height:100vh;}
.container{max-width:1400px;margin:0 auto;padding:20px;}
.header{background:linear-
gradient(135deg,rgba(255,255,255,0.2),rgba(255,255,255,0.1));backdrop-
filter:blur(20px);border-radius:25px;padding:30px;text-align:center;margin-
bottom:30px;border:1px solid rgba(255,255,255,0.2);}
.header h1{font-size:3em;margin:0;text-shadow:0 2px 10px rgba(0,0,0,0.3);}
.controls{display:flex;flex-wrap:wrap;gap:15px;justify-content:center;margin:30px 0;}
button{padding:15px 25px;border:none;border-radius:15px;cursor:pointer;font-
weight:bold;font-size:16px;transition:all 0.3s;box-shadow:0 5px 15px rgba(0,0,0,0.2);}
.btn-green{background:linear-gradient(45deg,#10b981,#059669);color:white;}
.btn-red{background:linear-gradient(45deg,#ef4444,#dc2626);color:white;}
.btn-blue{background:linear-gradient(45deg,#3b82f6,#2563eb);color:white;}
button:hover{transform:translateY(-3px);box-shadow:0 10px 25px rgba(0,0,0,0.3);}
input{padding:15px;border-radius:10px;border:1px solid rgba(255,255,255,0.3);font-
size:16px;width:220px;background:rgba(255,255,255,0.9);color:black;}
.grid{display:grid;grid-template-columns:1fr 1fr;gap:25px;margin:25px 0;}
.panel{background:rgba(255,255,255,0.95);color:black;padding:30px;border-
radius:20px;box-shadow:0 15px 35px rgba(0,0,0,0.2);border:1px solid
rgba(255,255,255,0.2);}
.panel h3{margin:0 0 20px;color:#333;font-size:1.4em;border-bottom:3px solid
#667eea;padding-bottom:10px;}
pre{background:#1a1a1a;color:#00ff88;padding:20px;border-
radius:15px;overflow:auto;font-family:'Fira Code','Courier New',monospace;font-
size:13px;max-height:350px;line-height:1.5;}
.chart-container{height:400px;border-radius:15px;overflow:hidden;}
.status{display:flex;justify-content:space-around;margin:20px 0;font-size:18px;font-
weight:bold;}
.status div{padding:15px 30px;border-radius:12px;}
.live{background:#10b981;color:white;}
.paused{background:#f59e0b;color:white;}
@media(max-width:768px){.grid{grid-template-columns:1fr;}}
</style></head>
<body>
<div class="container">
<div class="header">
<h1>🔥 Firewall PRO Dashboard</h1>
<p style="font-size:1.2em;opacity:0.9;">Real-time Traffic • Live Logs • IP Controls</p>
</div>
<div class="status">
<div class="live">🟢 LIVE - Auto Refresh Every 2s</div>
<div>📊 <span id="traffic-rate">100K RX/s | 50K TX/s</span></div>
</div>
<div class="controls">
<button class="btn-green" onclick="fwOn()">🔓 Enable Firewall</button>
<button class="btn-red" onclick="fwOff()">🔒 Disable Firewall</button>
<button class="btn-blue" onclick="flushFw()">🔄 Flush Rules</button>
</div>
<div class="controls">
<input id="blockip" placeholder="🚫 Enter IP to BLOCK ([Link])">
<button class="btn-red" onclick="blockIP()">🚫 BLOCK IP</button>
<input id="allowip" placeholder="✅ Enter IP to ALLOW ([Link])">
<button class="btn-green" onclick="allowIP()">✅ ALLOW IP</button>
</div>
<div class="grid">
<div class="panel"><h3>📋 Active Firewall Rules</h3><pre
id="rules">Loading...</pre></div>
<div class="panel"><h3>📈 LIVE Traffic Chart (KB/s)</h3><div class="chart-
container"><canvas id="trafficChart"></canvas></div></div>
</div>
<div class="grid">
<div class="panel"><h3>📉 Dropped Packets Counters</h3><pre
id="drops">Loading...</pre></div>
<div class="panel"><h3>📝 Live Logs (Last 25)</h3><pre
id="logs">Loading...</pre></div>
</div>
</div>
<script>
let trafficChart;
// Chart init
function initChart() {
const ctx = [Link]('trafficChart').getContext('2d');
trafficChart = new Chart(ctx, {
type: 'line',
data: {
labels: Array(10).fill(''),
datasets: [
{label: 'Inbound RX (KB/s)', data: Array(10).fill(100), borderColor:'#ef4444',
backgroundColor:'rgba(239,68,68,0.2)', borderWidth:4, fill:true, tension:0.4,
pointRadius:5},
{label: 'Outbound TX (KB/s)', data: Array(10).fill(50), borderColor:'#10b981',
backgroundColor:'rgba(16,185,129,0.2)', borderWidth:4, fill:true, tension:0.4,
pointRadius:5}
},
options: {
responsive: true,
maintainAspectRatio: false,
animation: false,
interaction: {intersect: false},
scales: {y: {beginAtZero: true, max: 600, grid: {color: 'rgba(0,0,0,0.1)'}}, x:
{display: false}},
plugins: {legend: {position: 'top'}}
});
function updateAll() {
fetch('/api/traffic').then(r=>[Link]()).then(data=>{
const time = new Date().toLocaleTimeString([],{hour:'2-digit',minute:'2-
digit',second:'2-digit'});
[Link](time);
[Link][0].[Link]([Link](0, [Link]));
[Link][1].[Link]([Link](0, [Link]));
if([Link] > 20) {
[Link]();
[Link][0].[Link]();
[Link][1].[Link]();
[Link]('none');
[Link]('traffic-rate').textContent =
`${[Link]([Link])}K RX/s | ${[Link]([Link])}K TX/s`;
});
fetch('/api/rules').then(r=>[Link]()).then(d=>[Link]('rules').textConte
nt=[Link]);
fetch('/api/drops').then(r=>[Link]()).then(d=>[Link]('drops').textCont
ent=[Link]);
fetch('/api/logs').then(r=>[Link]()).then(d=>[Link]('logs').textContent
=[Link]);
}
function fwOn() {fetch('/api/on').then(updateAll);}
function fwOff() {fetch('/api/off').then(updateAll);}
function flushFw() {fetch('/api/flush').then(updateAll);}
function blockIP() {
const ip = [Link]('blockip').[Link]();
if(ip && confirm(`🚫 Block ${ip}?\nAll traffic from this IP will be DROPPED!`)) {
fetch('/api/block',{method:'POST',headers:{'Content-Type':'application/
json'},body:[Link]({ip})})
.then(()=> {[Link]('blockip').value=''; updateAll();});
function allowIP() {
const ip = [Link]('allowip').[Link]();
if(ip && confirm(`✅ Allow ${ip}?\nTraffic from this IP will be permitted.`)) {
fetch('/api/allow',{method:'POST',headers:{'Content-Type':'application/
json'},body:[Link]({ip})})
.then(()=> {[Link]('allowip').value=''; updateAll();});
initChart();
updateAll();
setInterval(updateAll, 2000);
</script></body></html>
"""
@[Link]("/", methods=["GET", "POST"])
def login():
if [Link] == "POST":
if [Link]("username") == ADMIN_USER and
[Link]("password") == ADMIN_PASS:
session["auth"] = True
return redirect("/dashboard")
return LOGIN_HTML
@[Link]("/dashboard")
def dashboard():
if not [Link]("auth"):
return redirect("/")
return render_template_string(DASHBOARD_HTML)
@[Link]("/api/traffic")
def api_traffic():
return jsonify({
"rx": traffic_stats.get('rx', [Link](100, 400)),
"tx": traffic_stats.get('tx', [Link](50, 250))
})
@[Link]("/api/on")
def api_on():
[Link]()
return jsonify({"ok": True})
@[Link]("/api/off")
def api_off():
[Link]()
return jsonify({"ok": True})
@[Link]("/api/flush")
def api_flush():
[Link]()
return jsonify({"ok": True})
@[Link]("/api/block", methods=["POST"])
def api_block():
ip = [Link]("ip", "")
success = fw.block_ip(ip)
return jsonify({"success": success, "ip": ip})
@[Link]("/api/allow", methods=["POST"])
def api_allow():
ip = [Link]("ip", "")
success = fw.allow_ip(ip)
return jsonify({"success": success, "ip": ip})
@[Link]("/api/rules")
def api_rules():
return jsonify({"rules": fw.get_rules()})
@[Link]("/api/drops")
def api_drops():
return jsonify({"drops": fw.get_drops()})
@[Link]("/api/logs")
def api_logs():
return jsonify({"logs": fw.get_logs()})
if __name__ == "__main__":
print("🚀🔥 FIREWALL PRO v2.0 STARTING...")
print("📱 URL: [Link]
print("👤 Login: admin / admin123")
print("💡 Run: sudo python3 firewall_pro.py")
print("📊 Traffic Chart: 100% LIVE + SMOOTH")
[Link]()
[Link](host="[Link]", port=PORT, debug=False)
[Link] code:
#!/bin/bash
# ================================
# SAFE nftables Firewall + Web GUI
# ================================
set -e
WAN_IF="eth0"
LAN_IF="eth1"
LAN_NET="[Link]/24"
FLASK_PORT=9000
ADMIN_USER="admin"
ADMIN_PASS="admin123"
FLASK_APP_FILE="/tmp/firewall_admin.py"
echo 1 > /proc/sys/net/ipv4/ip_forward
nft flush ruleset
# Tables
nft add table inet firewall
nft add table ip nat
# Chains
nft add chain inet firewall input '{ type filter hook input priority 0;
policy drop; }'
nft add chain inet firewall forward '{ type filter hook forward
priority 0; policy drop; }'
nft add chain inet firewall output '{ type filter hook output priority
0; policy accept; }'
nft add chain ip nat postrouting '{ type nat hook postrouting
priority 100; }'
# INPUT rules
nft add rule inet firewall input iif lo accept
nft add rule inet firewall input ct state established,related accept
nft add rule inet firewall input ip protocol icmp accept
nft add rule inet firewall input tcp dport 22 accept
nft add rule inet firewall input tcp dport $FLASK_PORT accept
nft add rule inet firewall input log prefix "DROP_INPUT " counter
drop
# FORWARD rules
nft add rule inet firewall forward ct state established,related accept
nft add rule inet firewall forward iifname "$LAN_IF" oifname
"$WAN_IF" ip saddr $LAN_NET accept
nft add rule inet firewall forward log prefix "DROP_FORWARD "
counter drop
sudo nft add rule inet firewall output ip daddr [Link]/16 drop
# NAT
nft add rule ip nat postrouting oifname "$WAN_IF" masquerade
echo "[+] Firewall loaded successfully"
# ---------------- WEB ADMIN ----------------
cat > "$FLASK_APP_FILE" << PYEOF
from flask import Flask, request, redirect, render_template_string
app = Flask(__name__)
ADMIN_USER="$ADMIN_USER"
ADMIN_PASS="$ADMIN_PASS"
WAN_IF="$WAN_IF"
LAN_IF="$LAN_IF"
LAN_NET="$LAN_NET"
LOGIN_PAGE = '''
<h2>Firewall Login</h2>
<form method="post">
User: <input name="username"><br><br>
Pass: <input type="password" name="password"><br><br>
<input type="submit">
</form>
'''
DASHBOARD = '''
<h2>Firewall Dashboard</h2>
<p><b>WAN:</b> {{wan}}</p>
<p><b>LAN:</b> {{lan}}</p>
<p><b>LAN NET:</b> {{net}}</p>
'''
@[Link]("/", methods=["GET","POST"])
def login():
if [Link]=="POST":
if [Link]["username"]==ADMIN_USER and
[Link]["password"]==ADMIN_PASS:
return redirect("/dashboard")
return "Invalid login"
return LOGIN_PAGE
@[Link]("/dashboard")
def dashboard():
return render_template_string(DASHBOARD, wan=WAN_IF,
lan=LAN_IF, net=LAN_NET)
[Link](host="[Link]", port=$FLASK_PORT)
PYEOF
nohup python3 "$FLASK_APP_FILE" >/dev/null 2>&1 &
echo "================================="
echo " Firewall READY"
echo " Web: [Link]
echo " Login: admin / admin123"
echo "================================="
