🌊

TsunamiWall

Linux firewall + stealth honeypot • iptables/pfctl • payload capture • TUI

Server firewall with per-port honeypot listeners — blocks unsolicited inbound, allows only real services, drops+logs every probe and captures attacker payloads per country/IP.

View on GitHub ↗ Usage Guide Design

🛡️ Default-deny

Allow only listening services + explicit ports

🪤 Honeypot 1-65535

Stealth listeners on unused TCP ports

📦 Payloads by country

/var/log/tsunamiwall/bycountry/{CC}/{IP}

Quick Start

python3 -m venv .venv && .venv/bin/pip install -r requirements-dev.txt -e .
sudo mkdir -p /etc/tsunamiwall && sudo cp config/example-config.yaml /etc/tsunamiwall/config.yaml
sudo .venv/bin/python main.py -c /etc/tsunamiwall/config.yaml start
.venv/bin/python main.py status
.venv/bin/python main.py watch   # live TUI
./start.sh  # daemon + TUI, q to stop

CLI

allow <port> [--ip IP/CIDR]  deny <port>  block <port>  unblock <port>
allow --file list.txt  reset  logs  watch  status

Log Viewer

scripts/tsunamiwall-logs --recent -n 20 --ip 1.2.3.4 --country US --payloads
scripts/tsunamiwall-logs --stats --all-time  --archive --list-archives

Daemon: asyncio + pluggable backends iptables/ip6tables/pfctl/noop • Config: YAML /etc/tsunamiwall/config.yaml • MIT

Comments

0 comments