nftban

NFTBan

Linux Intrusion Prevention System & nftables Firewall Manager

CI/CD Status

Security & Supply Chain

2026 OSSRA Compliance

Security Hardening (2026 OSSRA Compliant)

This project implements a Zero-Trust CI/CD pipeline designed for the modern threat landscape:

See SECURITY.md for vulnerability reporting and supported versions.

NFTBan is an open-source Linux Intrusion Prevention System (IPS) and firewall manager built on nftables, designed to integrate cleanly with modern Linux security stacks.

It provides automated threat detection and response using native nftables for kernel-level enforcement, with Polkit-based privilege separation for secure operation without full root access.

Go Module Notice

NFTBan is a system-level firewall product, not a general-purpose Go library.

While this repository is a Go module and appears on pkg.go.dev, it is not designed or supported for use as an embeddable SDK. The Go packages exist to implement the NFTBan daemon, CLI, and internal tooling.

Supported Public Packages

For Integration with NFTBan

• CLI: nftban ban, nftban unban, nftban status
• Go IPC client: pkg/ipc — the supported public Go package
• HTTP API: http://127.0.0.1:9580/api/ (when daemon is running)

All packages under internal/ are implementation details and may change without notice between releases.

BETA | Tested on 5 lab servers. Community feedback needed from diverse environments. Report issues here.

Quick Install

Tier 0 — Primary Platforms

Ubuntu 24.04 LTS (Noble)

wget https://github.com/itcmsgr/nftban/releases/latest/download/nftban-ubuntu24.04-amd64.deb
sudo apt update && sudo apt install -y ./nftban-ubuntu24.04-amd64.deb && sudo nftban enable

Debian 12 (Bookworm)

wget https://github.com/itcmsgr/nftban/releases/latest/download/nftban-debian12-amd64.deb
sudo apt update && sudo apt install -y ./nftban-debian12-amd64.deb && sudo nftban enable

Rocky / AlmaLinux / RHEL 9

wget https://github.com/itcmsgr/nftban/releases/latest/download/nftban-el9-x86_64.rpm
sudo dnf install -y ./nftban-el9-x86_64.rpm && sudo nftban enable

Tier 1 — Future Platforms

Debian 13 (Trixie)

wget https://github.com/itcmsgr/nftban/releases/latest/download/nftban-debian13-amd64.deb
sudo apt update && sudo apt install -y ./nftban-debian13-amd64.deb && sudo nftban enable

Rocky / AlmaLinux / RHEL 10

wget https://github.com/itcmsgr/nftban/releases/latest/download/nftban-el10-x86_64.rpm
sudo dnf install -y ./nftban-el10-x86_64.rpm && sudo nftban enable

Tier 2 — Legacy Platforms

Ubuntu 22.04 LTS (Jammy)

wget https://github.com/itcmsgr/nftban/releases/latest/download/nftban-ubuntu22.04-amd64.deb
sudo apt update && sudo apt install -y ./nftban-ubuntu22.04-amd64.deb && sudo nftban enable

From Source

git clone https://github.com/itcmsgr/nftban.git && cd nftban
sudo ./install.sh cli    # CLI-only (~50MB RAM)
# or
sudo ./install.sh gui    # Full with Web GUI (~200MB RAM)

Available Packages

RPM Packages (EL Family)

DEB Packages (Ubuntu + Debian)

Packages are distro-specific and FHS compliant. Use the package matching your exact distribution version. See Supported Platforms for the full platform contract.

Features

Quick Start

# Verify installation
nftban version
nftban health summary

# Enable protection modules
nftban login enable      # SSH login monitoring
nftban feeds enable      # Threat intelligence feeds
nftban portscan enable   # Port scan detection

# Optional: Suricata IDS integration
nftban suricata install  # Install Suricata IDS
nftban suricata enable   # Enable with weekly rule updates

# Common operations
nftban ban 1.2.3.4       # Block IP
nftban unban 1.2.3.4     # Remove ban
nftban search 1.2.3.4    # Search across all sets
nftban firewall reload   # Atomic reload

# Check status
nftban status

CLI Overview

System & Health

nftban status          # System overview
nftban health          # Diagnostics with auto-heal
nftban validate        # Firewall structure validation
nftban services        # Systemd services status
nftban config validate # Validate config against schema

IP Management

nftban ban <IP>        # Ban IP (with optional timeout)
nftban unban <IP>      # Remove ban
nftban search <IP>     # Search across all sets
nftban whitelist add   # Add to whitelist

Protection Modules

nftban login status    # SSH login monitoring
nftban feeds list      # Threat feed status
nftban geoban list     # Geographic blocking
nftban portscan status # Port scan detection
nftban ddos status     # DDoS protection
nftban botguard status # HTTP bot guard (v1.20.0)
nftban tunnel status   # DNS tunnel suspicion (v1.30.0)

DNS Tunnel Suspicion (v1.30.0)

nftban tunnel enable       # Enable monitoring (disabled by default)
nftban tunnel status       # Show status and summary
nftban tunnel scan         # Run scan now
nftban tunnel top          # Show top suspects by score
nftban tunnel explain IP   # Signal breakdown for an IP
nftban tunnel config       # Show configuration

Advisory-only — the tunnel module scores DNS traffic for tunnel indicators but never bans or blocks. Enforcement is planned for a future release.

See CLI Commands Reference for complete documentation.

Architecture

ip nftban {                  # IPv4 rules
    set whitelist_ipv4 {...}   # Protected IPs (never blocked)
    set blacklist_ipv4 {...}   # Unified blocklist (all sources)
    set tcp_ports_in {...}     # Inbound TCP ports
    set udp_ports_in {...}     # Inbound UDP ports
    chain input {...}
    chain forward {...}
}

ip6 nftban {                 # IPv6 rules
    set whitelist_ipv6 {...}   # Protected IPs (never blocked)
    set blacklist_ipv6 {...}   # Unified blocklist (all sources)
    chain input {...}
    chain forward {...}
}

Components

How NFTBan Works

NFTBan operates as a CLI-driven firewall management system with a Go daemon backend:

User/Timer → CLI (Bash) → IPC Socket → Daemon (Go) → nftables (kernel)
                ↓                           ↓
          nft commands              ban/unban execution
          schema rebuild            login monitoring
          module management         feed processing

1. CLI (nftban) issues commands — ban, unban, enable modules, rebuild firewall
2. Daemon (nftband) handles long-running tasks — feed updates, login monitoring, IPC
3. nftables kernel enforces all rules — sets, chains, counters are the enforcement boundary
4. Atomic rebuild validates schema in a temp namespace before applying to production

The CLI communicates with the daemon via a Unix socket (/run/nftban/nftband.sock) authenticated with SO_PEERCRED. nftables rules are applied using transaction-based atomic operations — all rules load or none do.

CLI output is a report, not proof of enforcement. Kernel state is verified with nft list set commands.

Requirements

• Linux: Rocky/Alma/RHEL 9-10, CentOS Stream 9-10, Ubuntu 22.04+, Debian 12+
• nftables: 1.0+ (native backend)
• Bash: 4.4+
• systemd: 252+ (sysusers.d, tmpfiles.d support)
• jq: JSON processor (auto-installed)
• yq: YAML processor (auto-installed)
• Go 1.24+: For building from source (optional)

Supported Platforms

NFTBan uses a tiered support model. See the full platform contract for details.

Tier 0 — Primary (CI-Required)

Tier 1 — Future (Planned)

• Rocky Linux 10.x / AlmaLinux 10.x / RHEL 10
• Debian 13 (Trixie)
• Ubuntu 26.04 LTS

Tier 2 — Legacy (Best-Effort)

• Rocky/RHEL 8.x, Ubuntu 22.04, Debian 11

Development

NFTBan development uses AI tools for code generation and review. All code is human-reviewed and version-controlled.

License

NFTBan Core is licensed under the Mozilla Public License 2.0 (MPL-2.0).

Copyright (c) 2024-2026 NFTBan Project / Antonios Voulvoulis

What MPL-2.0 Means

MPL-2.0 is a file-level copyleft license:

• You may use, modify, and distribute NFTBan freely
• If you modify an MPL-licensed file, the modified file must remain under MPL-2.0 and be made available in source form
• You may combine MPL-licensed files with files under other licenses (including proprietary) in the same project — only the MPL files carry the copyleft obligation
• You do not need to open-source your own separate modules, integrations, or applications that use NFTBan

This means NFTBan can be integrated into proprietary infrastructure without requiring disclosure of your own code, as long as modifications to NFTBan's own files remain open.

See LICENSE for the full license text.

Architecture Boundary

The Core and Pro layers communicate via defined interfaces (CLI, IPC socket, HTTP API). They are architecturally separate.

Trademark

"NFTBan" is a trademark of the NFTBAN Project / Antonios Voulvoulis. The MPL-2.0 license grants rights to the code, not to the NFTBan name, logo, or brand. Forks must use a different name and branding. See TRADEMARK.md for the full policy.

Security & Supply Chain

NFTBan follows defense-in-depth security practices with 12 automated security tools across our CI/CD pipeline.

Security Certifications & Compliance

Certification	Status	Badge
OpenSSF Scorecard	7+ / 10
OpenSSF Best Practices	Passing
SLSA Level 3	Provenance
SBOM	Every Release	SPDX-JSON format

Automated Security Pipeline

Supply Chain Security

Source → Build → Attest → Release → Verify
   ↓       ↓        ↓         ↓        ↓
  Git   Hermetic  SLSA L3   SBOM    sigstore

• SLSA Level 3: Hermetic builds with non-forgeable provenance
• SBOM: Full Software Bill of Materials (SPDX-JSON) for every release
• Signed Releases: GPG-signed tags and artifacts
• Pinned Dependencies: All GitHub Actions pinned to SHAs

Security Dashboards

Vulnerability Disclosure

We follow coordinated disclosure with a 90-day fix window. Report vulnerabilities to:

• Email: security@nftban.com
• GitHub Security Advisories: Report a vulnerability

See SECURITY.md for complete security policy, threat model, and architecture.

Documentation

Getting Started

• Wiki Home — Complete documentation
• CLI Commands Reference — All commands
• Installation Guide — Prerequisites, install, post-config

Architecture & Security

• Architecture — System design and data flow
• Threat Model — Assets, adversaries, attack surfaces
• Security Policy — Vulnerability reporting, privilege model
• Reproducible Builds — Build verification

Integration

• Suricata IDS — IDS/IPS setup
• Control Panels — cPanel, DirectAdmin, Plesk

Community

• Website: https://nftban.com
• Report Bug
• Discussions

NFTBan — Linux IPS & nftables Firewall Manager
nftban.com | Report Issue | Discussions