fwscope 1.0.0

The first release of fwscope: a single-file, offline dashboard for firewall and WAF logs. Download index.html, open it in a browser, and drop your logs on it. Nothing is uploaded and nothing is installed.

Or use it online: https://magikh0e.github.io/fwscope/ (still runs entirely in your browser)

What it reads

• Firewalls: UFW; nftables, iptables and firewalld log lines (any log prefix); OPNsense / pfSense filterlog; Windows Firewall (pfirewall.log, or the Security log for program names)
• fail2ban: its own log, with bans, unbans and finds per jail
• WAFs: ModSecurity and Coraza (v3 JSON, mod_security2 JSON, native audit log, Apache and nginx error-log lines); Cloudflare firewall events (GraphQL API or Logpush)
• Plain, rotated and .gz files, journalctl text and JSON, pasted lines. Duplicates across files are skipped.

What you get

• Events over time (firewall and WAF on separate panels), top lists, a time-of-day heatmap, and a sortable events table
• A filter language (dpt:22 -src:203.0.113.0/24 act:block) with click-to-filter, and saved views in the page address
• A world map and network owners from a GeoIP database you drop in (.mmdb)
• Scan and hammering detection, a "new in the last" card, and a compare-two-periods card
• WAF: attack types, anomaly scores, the real visitor behind Cloudflare or a proxy, fake-crawler checks, "if blocking were on" thresholds, and tuning suggestions with drafted ModSecurity exclusions
• Block suggestions from WAF evidence, with scripts (and undo scripts) for UFW, ipset, nftables, OPNsense, Windows, ModSecurity and Cloudflare, plus fail2ban drafts
• An abuse report, a saved HTML report, and optional hostname lookups over DNS-over-HTTPS (off by default)

Tests

Every format, the filter language, views and block suggestions are covered by a test suite that runs on every push (npm test).

Licensed under GPL-3.0-or-later.