YH-FireWall

A lightweight firewall written in Go, using iptables + NFQUEUE for packet filtering.

---

Features

• Pure Go — single binary, no runtime dependencies
• iptables + NFQUEUE — intercepts packets at the netfilter level
• Rule engine — custom rules with groups and priority-based filtering
• Dynamic control — enable, disable, add, or remove rules at runtime
• Command-line client — manage everything from the terminal
• Web panel — optional web-based management interface

---

Install

curl -fsSL https://raw.githubusercontent.com/gralliry/YH-FireWall/master/install.sh | sudo bash

Or pin a specific version, or change the config file path:

# Latest version, custom config path
curl -fsSL https://raw.githubusercontent.com/gralliry/YH-FireWall/master/install.sh | sudo bash -s -- -c /custom/config.yaml

# Specific version, default config path
curl -fsSL https://raw.githubusercontent.com/gralliry/YH-FireWall/master/install.sh | sudo bash -s -- -v v1.0.0

# Both
curl -fsSL https://raw.githubusercontent.com/gralliry/YH-FireWall/master/install.sh | sudo bash -s -- -v v1.0.0 -c /custom/config.yaml

The installer auto-detects your architecture, downloads the latest release, verifies the checksum, installs the binary to /usr/local/bin/yfw, and sets up a systemd service.

The single binary acts as both daemon and client:

• yfw core — start the firewall daemon
• yfw <command> — manage the running daemon

Requirements

• Linux with iptables and libnetfilter_queue
• Root privileges

---

Usage

# List all rules
yfw rule list

# Get a specific rule
yfw rule list <rule_id>

# Add a rule
yfw rule add '{"srcNet":"0.0.0.0/0","tarPort":"80"}'

# Modify a rule
yfw rule change <rule_id> '{"srcNet":"192.168.1.0/24"}'

# Enable / disable a rule
yfw rule enable <rule_id>
yfw rule disable <rule_id>

# Remove a rule
yfw rule remove <rule_id>

---

Configuration

The config file lives at /etc/yfw/config.yaml:

queue_no: 0

web:
  enable: true
  address: 0.0.0.0:8080
  auth_username: admin
  auth_password: admin
  enable_cors: true

cmd:
  enable: true
  socket_path: /tmp/yfw.sock

rule_table:
  path: /etc/yfw/rule.json

---

Service Management

systemctl status yfw     # check status
systemctl start yfw      # start
systemctl stop yfw       # stop
systemctl restart yfw    # restart
journalctl -u yfw -f     # follow logs

---

License

MIT © Gralliry