A eBPF based firewall to block traffic using the Country or the ASN
Go to file
2025-01-21 12:13:31 +05:30
geofw feat: pull asn/country dbs from maxmind every 24h, completed ebpf module to drop based on the given rules 2025-01-21 12:13:31 +05:30
geofw-common feat: pull asn/country dbs from maxmind every 24h, completed ebpf module to drop based on the given rules 2025-01-21 12:13:31 +05:30
geofw-ebpf feat: pull asn/country dbs from maxmind every 24h, completed ebpf module to drop based on the given rules 2025-01-21 12:13:31 +05:30
.gitignore feat: pull asn/country dbs from maxmind every 24h, completed ebpf module to drop based on the given rules 2025-01-21 12:13:31 +05:30
Cargo.lock feat: pull asn/country dbs from maxmind every 24h, completed ebpf module to drop based on the given rules 2025-01-21 12:13:31 +05:30
Cargo.toml added initial version with ringbuffers and queues 2025-01-18 12:33:36 +05:30
config.json feat: pull asn/country dbs from maxmind every 24h, completed ebpf module to drop based on the given rules 2025-01-21 12:13:31 +05:30
README.md added initial version with ringbuffers and queues 2025-01-18 12:33:36 +05:30
run.sh feat: pull asn/country dbs from maxmind every 24h, completed ebpf module to drop based on the given rules 2025-01-21 12:13:31 +05:30
rustfmt.toml added initial version with ringbuffers and queues 2025-01-18 12:33:36 +05:30

geofw

Prerequisites

  1. stable rust toolchains: rustup toolchain install stable
  2. nightly rust toolchains: rustup toolchain install nightly --component rust-src
  3. (if cross-compiling) rustup target: rustup target add ${ARCH}-unknown-linux-musl
  4. (if cross-compiling) LLVM: (e.g.) brew install llvm (on macOS)
  5. (if cross-compiling) C toolchain: (e.g.) brew install filosottile/musl-cross/musl-cross (on macOS)
  6. bpf-linker: cargo install bpf-linker (--no-default-features on macOS)

Build & Run

Use cargo build, cargo check, etc. as normal. Run your program with:

cargo run --release --config 'target."cfg(all())".runner="sudo -E"'

Cargo build scripts are used to automatically build the eBPF correctly and include it in the program.

Cross-compiling on macOS

Cross compilation should work on both Intel and Apple Silicon Macs.

CC=${ARCH}-linux-musl-gcc cargo build --package geofw --release \
  --target=${ARCH}-unknown-linux-musl \
  --config=target.${ARCH}-unknown-linux-musl.linker=\"${ARCH}-linux-musl-gcc\"

The cross-compiled program target/${ARCH}-unknown-linux-musl/release/geofw can be copied to a Linux server or VM and run there.