# Foomuuri

Foomuuri is a multizone bidirectional nftables firewall.

Full documentation is available [here](https://foomuuri.foobar.fi/latest/).
See [host firewall](https://foomuuri.foobar.fi/latest/example/host-firewall/)
or [router firewall](https://foomuuri.foobar.fi/latest/example/router-firewall/)
for example configuration files.

[Installation](https://foomuuri.foobar.fi/latest/install/)
page contains instructions how to install Foomuuri. Help is available
via [GitHub discussions](https://github.com/FoobarOy/foomuuri/discussions)
and IRC channel `#foomuuri` on Libera.Chat.


## Features

* Firewall zones
* Bidirectional firewalling for incoming, outgoing and forwarding traffic
* Suitable for all systems from personal laptop to corporate firewalls
* Rich rule language for flexible and complex rules
* Predefined list of services for simple rule writing
* Rule language supports macros and templates
* IPv4 and IPv6 support with automatic rule splitting per protocol
* SNAT, DNAT and masquerading support
* Logging and counting
* Rate limiting
* DNS hostname lookup and IP-list support with dynamic IP address refreshing
* Country database support aka geolocation
* Multiple ISP support with internal network connectivity monitor
* IPsec matching support
* Ability to map certain traffic to separate zones
* Automatic IP address banning support
* Port knocking support
* D-Bus API
* Firewalld emulation for NetworkManager's zone support
* Raw nftables rules can be used
* Fresh design, written to use modern nftables's features


## Example configuration

Example configuration file to filter incoming traffic only:

```
zone {
  localhost
  public  eth1  # Interface list can be empty if using NetworkManager
}

public-localhost {  # Allow specified incoming traffic
  dhcp-client
  dhcpv6-client
  ping
  ssh
  drop log
}

localhost-public {  # Allow all outgoing traffic
  accept
}
```
