FFFUU browser standalone

This is a version of our Iptables firewall analysis tool fffuu compiled with haste. It does not submit any of the entered data to our webservers.

iptables-save input

# Generated by iptables-save v1.6.0 on Wed Mar 22 11:39:49 2017 *filter :INPUT DROP [1:44] :FORWARD DROP [0:0] :OUTPUT ACCEPT [82:540305] :BasicSvc - [0:0] :FromInternalF - [0:0] :PError - [0:0] -A FORWARD -d 10.0.0.0/8 -o lup -j DROP -A FORWARD -i lup -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i lmd -j FromInternalF -A FORWARD -i ldit -j FromInternalF -A FORWARD -i loben -j FromInternalF -A FORWARD -i wt -j FromInternalF -A FORWARD -i wg -m state --state ESTABLISHED -j FromInternalF -A FORWARD -i vshit -m state --state ESTABLISHED -j FromInternalF -A FORWARD -i vshit -o lup -j ACCEPT -A FORWARD -i wg -o lup -j ACCEPT -A FORWARD -i lua -o lup -j ACCEPT -A FORWARD -o vshit -p tcp -m tcp --dport 443 -j ACCEPT -A FORWARD -i vocb -o lup -p udp -m udp --dport 53 -m comment --comment DNS -j ACCEPT -A FORWARD -i vocb -o lup -p tcp -m tcp --dport 53 -m comment --comment DNS -j ACCEPT -A FORWARD -d 81.169.168.252/32 -i vocb -o lup -p udp -m udp --dport 1194 -j ACCEPT -A FORWARD -d 81.169.168.252/32 -i vocb -o lup -p tcp -m tcp --dport 80 -j ACCEPT -A FORWARD -d 141.76.2.4/32 -i vocb -o lup -p tcp -j ACCEPT -A FORWARD -d 212.211.132.250/32 -i vocb -o lup -p tcp -j ACCEPT -A FORWARD -d 212.211.132.32/32 -i vocb -o lup -p tcp -j ACCEPT -A FORWARD -d 81.169.168.252/32 -i vocb -o lup -p tcp -m tcp --dport 443 -j ACCEPT -A FORWARD -d 178.254.55.220/32 -i vocb -o lup -p tcp -m tcp --dport 1337 -j ACCEPT -A BasicSvc -p udp -m udp --sport 67:68 --dport 67:68 -j ACCEPT -A BasicSvc -p udp -m udp --dport 53 -j ACCEPT -A BasicSvc -p tcp -m tcp --dport 15678 -j ACCEPT -A BasicSvc -p tcp -m tcp --dport 80 -j ACCEPT -A FromInternalF -o lmd -j ACCEPT -A FromInternalF -o ldit -j ACCEPT -A FromInternalF -o loben -j ACCEPT -A FromInternalF -o wt -j ACCEPT -A FromInternalF -o lup -j ACCEPT -A FromInternalF -o vshit -j ACCEPT -A FromInternalF -o wg -m state --state ESTABLISHED -j ACCEPT -A PError -p tcp -j REJECT --reject-with tcp-reset -A PError -p udp -j REJECT --reject-with icmp-port-unreachable -A PError -j REJECT --reject-with icmp-proto-unreachable COMMIT # Completed on Wed Mar 22 11:39:49 2017

IP assignment

Description of which IP addresses may appear on which interfaces. Leaving it empty is safe for service matrix generation, but can result in a useless (but correct) result.
lo = [127.0.0.0/8] ldit = [10.13.42.136/29] lmd = [10.13.42.128/29] loben = [10.13.42.144/28] wt = [10.13.42.160/28] wg = [10.13.41.0/27] lup = all_but_those_ips [ 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 ] vpriv = [10.13.37.0/24,10.13.44.0/24] vshit = [10.13.43.0/28] vocb = [10.13.43.16/28] lua = []

Main routing table

Only provide this if system only has a single routing table for forwarding!
default via 14.15.16.1 dev lup proto dhcp src 14.15.16.58 metric 1024 10.13.37.0/24 via 255.255.255.0 dev vpriv 10.13.41.0/27 dev wg proto kernel scope link src 10.13.41.1 10.13.42.128/29 dev lmd proto kernel scope link src 10.13.42.129 10.13.42.136/29 dev ldit proto kernel scope link src 10.13.42.137 10.13.42.144/28 dev loben proto kernel scope link src 10.13.42.145 10.13.42.160/28 dev wt proto kernel scope link src 10.13.42.161 10.13.43.0/28 dev vshit proto kernel scope link src 10.13.43.1 10.13.43.16/28 dev vocb proto kernel scope link src 10.13.43.17 10.13.44.0/24 via 255.255.255.0 dev vpriv 14.15.16.0/24 dev lup proto kernel scope link src 14.15.16.58 14.15.16.1 dev lup proto dhcp scope link src 14.15.16.58 metric 1024

Action

Analyze!
Please be aware that there a certain limitations to this JS-version of the tool:

• The default stack size is fairly small, so not all firewalls can be processed.
• We had to deactivate the optimizations for machine word operations, which results in a severe performance penalty: normally, the analysis of the example input will complete in a matter of seconds.

Output