Is it possible to write a firewall in python?

Question

Hey everyone, Is it possible to write a firewall in python? Say it would block all traffic?

Thanks!

Jake

Answer 1

I'm sure it's probably possible, but ill-advised. As mcandre mentions, most OSes couple the low level networking capabilities you need for a firewall tightly into the kernel and thus this task is usually done in C/C++ and integrates tightly with the kernel. The microkernel OSes (Mach et al) might be more amenable than linux. You may be able to mix some python and C, but I think the more interesting discussion here is going to be around "why should I"/"why shouldn't I" implement a firewall in python as opposed to just is it technically possible.

Answer 2

"Yes" - that's usually the answer to "is it possible...?" questions.

How difficult and specific implementations are something else entirely. I suppose technically in a don't do this sort of way, if you were hell-bent on making a quick firewall in Python, you could use the socket libraries and open connections to and from yourself on every port. I have no clue how effective that would be, though it seems like it wouldn't be. Of course, if you're simply interested in rolling your own, and doing this as a learning experience, then cool, you have a long road ahead of you and plenty of education.

OTOH, if you're actually worried about network security there are tons of other products out there that you can use, from iptables on *nix, to ZoneAlarm on windows. Plenty of them are both free and secure so there's really no reason to roll your own except on an "I want to learn" basis.

Answer 3

I'm sure in theory you could achieve what you want, but I believe in practice your idea is not doable (if you wonder why, it's because it's too hard to "interface" a high level language with the low level kernel).

What you could do instead is some Python tool that controls the firewall of the operating system so you could add rules, delete , etc. (in a similar way to what iptables does in Linux).

Answer 4

Yes, yes it is.

I have some python code that interacts with linux iptables to perform firewalling duties, using nfqueue. I can use a rule in iptables that looks like:

iptables -A INPUT -j NFQUEUE --queue-num 1

And then have some python code that looks like:

import nfqueue
from dpkt import ip

q = None

def cb(dummy, payload):
    # make decision about if the packet should be allowed. in this case, drop everything:
    payload.set_verdict(nfqueue.NF_DROP)

q = nfqueue.queue()
q.open()
q.bind()
q.set_callback(cb)
q.create_queue(1)

q.try_run()