FWTrash

Log trash detector • nginx/auth/tcpdump → rules & modules → iptables • v2.0

Pipe any .log into FWTrash — it splits lines via modules (http/ssh/tcpdump), matches JSON rules with brute-force counters, and executes iptables DROP or custom commands. Wrong rules can block yourself!

View on GitHub ↗ v2 Dashboard Modified Apache 2.0

📜 Rules JSON

type 1-8: regex/base64/plain/length, key/climit/tlimit bruteforce

🔌 Modules

http, ssh, tcpdump parse lines → values for rules

⚙️ Piped

tail -f nginx.log | fwtrash → badips.out trash.out

Quick Start

nohup ./runwhile_http.sh &  # or
tail -f /var/log/nginx/access.log | ./fwtrash.py -P rules/http.rules -o badips.out -O trash_http.out -p modules.http -s "date,ip,repeat,req;60,ref;20,ua;20,code,len" -S "[--DATE] - ([--REPEAT],[--CODE],[--LEN]) [--IP] => [--REQ]" -c "iptables -A INPUT -s [--IP]/32 -j DROP" -b "key:1,climit:3,tlimit:5"

# tcpdump spoof hunt
tcpdump -r out.cap -nn -s0 port 443 | python fwtrash.py -D -d -P rules/tcpdump.rules -p modules.tcpdump -c 'echo "BADIP: [--IP]"'

# v2 no pip install
pip install -r requirements.txt && python main.py run -P rules/http.rules

v0.6 tcpdump module • v2 adds FastAPI dashboard • License: Modified Apache 2.0 + commercial notification/payment/audit, law Canary Islands/SI fallback • Contact w4d4f4k@gmail.com

Comments

0 comments