Skip to content

Operational Scenarios

Jump to bottom
Ryan edited this page Jul 18, 2026 · 1 revision

Operational Scenarios

Real-world usage examples for common firewall management tasks. Each scenario shows the complete workflow with commands, expected output descriptions, and operational notes.

Table of Contents

Scenario 1: Secure a New Web Server

A fresh server needs HTTP, HTTPS, and SSH access with everything else blocked.

# Step 1: Detect system and available firewalls
sudo python3 apotropaios.py detect

# Step 2: Create a baseline backup before changes
sudo python3 apotropaios.py backup pre-webserver-setup

# Step 3: Allow essential services
sudo python3 apotropaios.py add-rule --protocol tcp --dst-port 80 --action accept \
    --description "HTTP web traffic"
sudo python3 apotropaios.py add-rule --protocol tcp --dst-port 443 --action accept \
    --description "HTTPS web traffic"

# Step 4: Allow SSH from admin network only
sudo python3 apotropaios.py add-rule --protocol tcp --dst-port 22 --src-ip 10.0.0.0/24 \
    --action accept --description "SSH admin access from 10.0.0.0/24"

# Step 5: Allow established connections (stateful baseline)
sudo python3 apotropaios.py add-rule --conn-state established,related --action accept \
    --description "Stateful: established and related"

# Step 6: Log and drop everything else
sudo python3 apotropaios.py add-rule --action log,drop \
    --log-prefix "APO:DEFAULT_DROP: " --description "Default deny with logging"

# Step 7: Verify
sudo python3 apotropaios.py list-rules        # Show tracked rules (5 rules)
sudo python3 apotropaios.py system-rules      # Verify native rules match

Operational note: Rule order matters in iptables. Rules are applied in the order they appear in the chain. The default-deny rule should be last. Apotropaios appends rules in creation order.

Scenario 2: Temporary Maintenance Window

Grant temporary access for a maintenance team member, with automatic expiry.

# Grant temporary SSH access for 4 hours (14400 seconds)
sudo python3 apotropaios.py add-rule --protocol tcp --dst-port 22 \
    --src-ip 203.0.113.50 --action accept \
    --duration temporary --ttl 14400 \
    --description "Temp SSH for maintenance engineer Alice"

# Grant temporary HTTPS access for 2 hours
sudo python3 apotropaios.py add-rule --protocol tcp --dst-port 8443 \
    --src-ip 203.0.113.50 --action accept \
    --duration temporary --ttl 7200 \
    --description "Temp admin panel access for Alice"

# Monitor via interactive menu (ExpiryMonitor will auto-deactivate when TTL expires)
sudo python3 apotropaios.py --interactive

# Or check manually
sudo python3 apotropaios.py list-rules    # Shows time remaining for temp rules

Operational note: The ExpiryMonitor daemon thread only runs during interactive menu mode (30-second check interval). In CLI mode, expired rules are checked once at startup. For critical temporary rules, use the interactive menu to ensure automatic deactivation.

Scenario 3: Emergency Block and Recovery

A security incident requires immediate traffic blocking, followed by investigation and recovery.

# EMERGENCY: Block all traffic immediately
sudo python3 apotropaios.py block-all
# WARNING: This blocks ALL traffic including SSH.
# Ensure you have out-of-band access (console, IPMI, physical)

# Investigate the issue...
# Check logs for suspicious activity
sudo cat $(ls -t data/logs/*.log | head -1) | grep -E 'ERROR|CRITICAL|WARNING'

# Option A: Restore from last known good state
sudo python3 apotropaios.py restore data/backups/apotropaios_backup_pre-incident_*.tar.gz

# Option B: Allow all traffic and rebuild rules
sudo python3 apotropaios.py allow-all

# Either way, verify the result
sudo python3 apotropaios.py list-rules
sudo python3 apotropaios.py system-rules

Scenario 4: Bulk Rule Import from Template

Deploy a standardized rule set across multiple servers.

# Create the template file
cat > /tmp/web-server-rules.conf << 'EOF'
direction=inbound
protocol=tcp
dst_port=80
action=accept
description=HTTP

direction=inbound
protocol=tcp
dst_port=443
action=accept
description=HTTPS

direction=inbound
protocol=tcp
dst_port=22
src_ip=10.0.0.0/24
action=accept
description=SSH admin only

direction=inbound
conn_state=established,related
action=accept
description=Stateful baseline

direction=inbound
action=log,drop
log_prefix=APO:DROP:
description=Default deny
EOF

# Validate on first server (dry run -- no rules applied)
sudo python3 apotropaios.py import /tmp/web-server-rules.conf --dry-run
# Output: [DRY RUN] Import complete: 5 success, 0 errors, 0 skipped

# Apply if validation passes
sudo python3 apotropaios.py import /tmp/web-server-rules.conf
# Output: Import complete: 5 success, 0 errors, 0 skipped

# Export for use on other servers (generates .sha256 sidecar)
sudo python3 apotropaios.py export /tmp/production-rules.conf
# Copy both files to the next server

Operational note: If a .sha256 sidecar file exists alongside the import file, the checksum is verified before processing. If verification fails, the import is aborted. This prevents tampered rule files from being applied.

Scenario 5: Multi-Backend Management

Work with multiple firewall backends on the same system.

# Check which backends are installed
sudo python3 apotropaios.py detect

# Work with iptables
sudo python3 apotropaios.py --backend iptables add-rule --dst-port 443 --action accept
sudo python3 apotropaios.py --backend iptables system-rules

# Switch to firewalld for a zone-aware rule
sudo python3 apotropaios.py --backend firewalld add-rule --dst-port 8080 \
    --action accept --zone public --description "App server via firewalld"

# Check status across backends
sudo python3 apotropaios.py status    # Shows all backends with running/enabled state

# Rules are tagged with their backend -- removal auto-routes correctly
sudo python3 apotropaios.py list-rules    # Shows backend column per rule
sudo python3 apotropaios.py remove-rule <UUID>    # Auto-routes to correct backend

Scenario 6: Backup and Recovery Workflow

Protect configuration before and after changes.

# Before deployment: create labeled backup
sudo python3 apotropaios.py backup pre-deploy-v2.1

# Make changes...
sudo python3 apotropaios.py add-rule --dst-port 8080 --action accept

# After deployment verification: create another backup
sudo python3 apotropaios.py backup post-deploy-v2.1

# Something goes wrong -- restore pre-deployment state
sudo python3 apotropaios.py restore data/backups/apotropaios_backup_pre-deploy-v2.1_*.tar.gz
# A pre-restore safety backup is automatically created before the restore

# For compliance: create an immutable snapshot (via interactive menu)
# Backup & Recovery > Create immutable snapshot
# The snapshot uses chattr +i to prevent modification even by root

Backup contents: Each archive contains per-backend config exports (iptables-save output, nft list ruleset output, ipset save output, firewalld zone XML files, and the complete /etc/ufw configuration directory alongside a human-readable ufw status dump), rule_index.dat, rule_state.dat, and a JSON manifest with timestamp, label, and backend scope. Backups taken from the interactive menu include the same rule index and state files as CLI backups.

Scenario 7: Rate Limiting for Brute Force Protection

Protect services from brute force and DDoS attacks.

# Rate-limit SSH connections (5 per minute, burst of 10)
sudo python3 apotropaios.py add-rule --protocol tcp --dst-port 22 \
    --action accept --limit 5/minute --limit-burst 10 \
    --description "SSH rate limited"

# Log and drop excessive connection attempts
sudo python3 apotropaios.py add-rule --protocol tcp --dst-port 22 \
    --action log,drop --limit 10/minute \
    --log-prefix "APO:SSH_BRUTE: " \
    --description "Log excessive SSH attempts"

# Rate limit ICMP (ping flood mitigation)
sudo python3 apotropaios.py add-rule --protocol icmp --action log,accept \
    --limit 1/second --limit-burst 5 \
    --log-prefix "APO:ICMP: " --description "ICMP flood protection"

# Rate limit HTTP to prevent application-layer DDoS
sudo python3 apotropaios.py add-rule --protocol tcp --dst-port 80 \
    --action accept --limit 100/minute \
    --description "HTTP rate limit"

Backend translation: iptables uses -m limit --limit N/unit --limit-burst N. nftables uses limit rate N/unit burst N packets. firewalld uses rich rule limit value="N/m".

Scenario 8: Stateful Firewall Baseline

Build a proper stateful firewall from scratch.

# Step 1: Allow loopback (always needed)
sudo python3 apotropaios.py add-rule --interface lo --action accept \
    --description "Allow loopback"

# Step 2: Allow established and related connections
sudo python3 apotropaios.py add-rule --conn-state established,related --action accept \
    --description "Stateful: allow established/related"

# Step 3: Drop invalid packets
sudo python3 apotropaios.py add-rule --conn-state invalid --action drop \
    --description "Drop invalid packets"

# Step 4: Allow specific new connections
sudo python3 apotropaios.py add-rule --protocol tcp --dst-port 22 \
    --conn-state new --action accept --src-ip 10.0.0.0/24 \
    --description "SSH from admin network (new connections only)"
sudo python3 apotropaios.py add-rule --protocol tcp --dst-port 443 \
    --conn-state new --action accept \
    --description "HTTPS (new connections)"

# Step 5: Default deny with logging
sudo python3 apotropaios.py add-rule --action log,drop \
    --log-prefix "APO:DEFAULT: " --description "Default deny"

Scenario 9: Migration Between Backends

Move from iptables to nftables.

# Export current rules
sudo python3 apotropaios.py export /tmp/migration-rules.conf

# Create backup of current state
sudo python3 apotropaios.py backup pre-migration-iptables

# Switch backend
sudo python3 apotropaios.py --backend nftables status

# Import rules to new backend
sudo python3 apotropaios.py --backend nftables import /tmp/migration-rules.conf --dry-run
sudo python3 apotropaios.py --backend nftables import /tmp/migration-rules.conf

# Verify
sudo python3 apotropaios.py --backend nftables list-rules
sudo python3 apotropaios.py --backend nftables system-rules

# Create post-migration backup
sudo python3 apotropaios.py backup post-migration-nftables

Note: Rule import re-creates rules through the validation and creation pipeline. Backend-specific options (like iptables chain names) are translated to the new backend's equivalent automatically.

Apotropaios Firewall Manager -- Python Variant · Home · Quick Start · Architecture · Security · Bash Variant

Apotropaios -- Python Variant

Getting Started

Architecture

Operations

Project

35 files · 14,545 lines · 322 tests

Clone this wiki locally