Home
Unified, security-focused firewall management for Linux
Welcome to the Apotropaios wiki. Apotropaios is a zero-dependency Python 3.12+ framework for managing firewall rules across multiple backends and Linux distributions through a single consistent interface.
Apotropaios (from Greek ἀποτρόπαιος -- "turning away evil") provides unified management of firewall rules across iptables, nftables, firewalld, ufw, and ipset. It supports Ubuntu, Kali Linux, Debian, Rocky Linux, AlmaLinux, and Arch Linux.
This is the Python variant of the bash Apotropaios framework, targeting 100% feature parity with v1.1.10.
| Capability | Description |
|---|---|
| Unified Interface | One tool to manage rules across five firewall backends with consistent CLI and menu |
| Rule Lifecycle | UUID-tracked rules with create, activate, deactivate, remove, and automatic TTL expiry |
| Compound Actions |
log,drop and log,accept translated natively per backend -- separate rules for iptables, single expression for nftables, rich rules for firewalld |
| Connection Tracking |
new, established, related, invalid, untracked states on any rule |
| Rate Limiting | Per-rule rate limiting with configurable burst: 5/minute, 10/second, 100/hour
|
| Configuration Portability | Import/export rule sets with SHA-256 integrity verification and dry-run preview |
| Backup & Recovery | Timestamped compressed archives, immutable chattr +i snapshots, automatic pre-restore safety backups |
| Security-First | 27 whitelist input validators, CWE-mapped security test suite, 4-family log credential masking, no shell=True ever |
| Type-Safe |
mypy --strict with zero errors across all 35 source files |
| Zero Dependencies | Python 3.12+ stdlib only -- no pip packages required at runtime |
| Page | Description |
|---|---|
| Getting Started | |
| Quick Start Guide | Get running in 2 minutes -- no installation required |
| Usage Guide | Complete CLI and interactive menu reference |
| Configuration Reference | Every tunable constant with implications and defaults |
| Architecture | |
| Architecture and Design | 5-layer system architecture with mermaid diagrams and design rationale |
| Developer Guide | Component catalog -- every module, class, function with design decisions |
| Development Guide | Coding standards, testing patterns, contribution workflow |
| Operations | |
| Operational Scenarios | Real-world usage examples: web server, maintenance windows, emergency block, bulk import |
| Troubleshooting Guide | Common issues with root cause analysis and diagnostic commands |
| FAQ | 40+ frequently asked questions organized by topic |
| Project | |
| Contributing | How to contribute: PR process, review criteria, known pitfalls |
| Security Policy | Vulnerability reporting, security design, CWE coverage, threat model |
| Changelog | Complete version history with detailed per-sprint changes |
| Metric | Value |
|---|---|
| Production source files | 35 |
| Total source lines | 14,545 |
| Automated tests | 322 (unit + integration + security) |
| mypy --strict errors | 0 |
| Firewall backends | 5 (iptables, nftables, firewalld, ufw, ipset) |
| Target platforms | 7 (Ubuntu, Kali, Debian, Rocky, Alma, Arch) |
| CLI commands | 18 |
| Input validators | 27 |
| Log credential masking families | 4 |
| External runtime dependencies | 0 |
| Documentation files | 27 |
| Documentation lines | 5,000+ |
| Makefile targets | 56 |