Author: Trix Cyrus

Waymap Pentesting tool: Click Here
TrixSec Github: Click Here

Prerequisites
Before diving into the implementation, you’ll need to have:

Basic knowledge of Python programming.
Python 3 installed on your system.
scapy library for packet manipulation (install using pip install scapy).
Administrative privileges on your machine to run network commands.

Understanding How Firewalls Work

A firewall acts as a barrier between your home network and the internet. It filters incoming and outgoing traffic based on predefined security rules. Firewalls can block malicious traffic and allow legitimate traffic, providing a layer of security.

Setting Up Your Python Firewall

1. Import Required Libraries
Start by importing the necessary libraries:

from scapy.all import *

2. Define Packet Filtering Rules
You can create a list of filtering rules based on IP addresses, protocols, and ports. Here’s a basic example:

# List of allowed IPs
allowed_ips = ['192.168.1.1', '192.168.1.2']  # Add your trusted IPs here

# Function to check if the packet is allowed
def is_allowed(packet):
    if IP in packet:
        return packet[IP].src in allowed_ips
    return False

3. Packet Sniffing and Filtering
Using scapy, you can sniff packets and apply the filtering rules:

def packet_callback(packet):
    if is_allowed(packet):
        print(f"Allowed packet: {packet.summary()}")
    else:
        print(f"Blocked packet: {packet.summary()}")

# Start sniffing the packets
sniff(prn=packet_callback, filter="ip", store=0)

4. Running the Firewall
To run your firewall, save the script as simple_firewall.py and execute it with administrative privileges:

sudo python3 simple_firewall.py

5. Testing the Firewall
You can test your firewall by trying to ping the allowed and blocked IP addresses. Check the console output to see if the packets are allowed or blocked according to your rules.

Limitations and Considerations
This simple firewall is just a basic implementation for educational purposes. Some limitations include:

No Stateful Inspection: This firewall does not maintain connection states.
Limited Rule Complexity: It can only filter based on IP addresses, and adding more complex rules requires additional coding.
Performance: Python may not handle high traffic volumes efficiently compared to dedicated firewall solutions.

~Trixsec