Firewall

Firewall is an Enterprise module that provides application-level IP blocking with flexible response actions. Block individual IPs or entire CIDR ranges and choose how HomeDock OS responds to blocked requests.

_{Firewall operates at the application layer, providing an additional security barrier that complements your network-level firewalls and iptables rules. This follows the defense in depth security principle.}

Dashboard Overview

The Firewall dashboard displays real-time statistics:

Metric	Description
IPs	Total individual IPs blocked
Ranges	Total CIDR ranges blocked
Blocks	Total block events (hits) recorded

Block Actions

Choose how HomeDock OS responds to blocked IPs:

Action	Response	Use Case
Block	Returns 403 Forbidden	Standard blocking, client knows they’re blocked
Redirect	Redirects to custom URL	Send attackers to a honeypot or info page
Tarpit	Slow response (~30s)	Waste attacker resources, slow down scanners
Drop	No response (timeout)	Stealth mode, appear offline to attacker

Adding Rules

Block a Single IP

1. Select Single IP mode
2. Choose the desired action (Block, Redirect, Tarpit, or Drop)
3. Enter the IP address (e.g., 192.168.1.100)
4. Optionally add a reason for documentation
5. If using Redirect, enter the destination URL
6. Click Add Rule

Block an IP Range

1. Select IP Range (CIDR) mode
2. Choose the desired action
3. Enter the CIDR notation (e.g., 192.168.1.0/24)
4. Optionally add a reason
5. Click Add Rule

CIDR notation allows blocking entire subnets. For example, /24 blocks 256 addresses, /16 blocks 65,536 addresses.

Managing Blocked IPs

The interface displays two tables:

Blocked IPs Table

Shows individual blocked IP addresses with:

• IP Address: The blocked IP
• Action: Current response action
• Reason: Why it was blocked
• Blocked At: When the rule was created
• Hits: Number of blocked requests from this IP

Blocked Ranges Table

Shows blocked CIDR ranges with the same information plus the number of IPs covered by the range.

Unblocking

To remove a block:

1. Find the IP or range in the appropriate table
2. Click the green checkmark button
3. The rule is immediately removed

Use Cases

Blocking Malicious Actors

After identifying attack patterns in Audit Trail, block the source:

• Use Block for immediate denial
• Use Tarpit to slow down automated attacks

Geo-blocking

Block entire IP ranges from regions you don’t serve:

• Add CIDR ranges for unwanted regions
• Use Drop to appear offline

Honeypot Redirection

Redirect attackers to a monitoring endpoint:

• Use Redirect action
• Point to a honeypot URL for analysis

Rate Limit Enforcement

Complement Shield Mode with permanent blocks:

• Block IPs that repeatedly trigger Shield Mode
• Add reason for audit purposes

Be careful when blocking IP ranges. Verify the CIDR notation to avoid accidentally blocking legitimate users.