Implementation of NFtables and Fail2ban on Linux Server for Adaptive Defense Firewall Development
TL;DR
This research aims to develop a prototype of an Adaptive Defense Firewall web application that integrates firewalld, nftables, and fail2ban centrally and is able to dynamically adjust fail2ban mitigation parameters and kernel-level blocking by nftables.
Abstract
Linux server security management today faces the challenges of command-line configuration complexity and slow response to automated attacks. This research aims to develop a prototype of an Adaptive Defense Firewall web application that integrates firewalld, nftables, and fail2ban centrally. The importance of this research lies in the provision of visual management that makes it easier for administrators to mitigate network intrusions in real-time. The novelty offered is the Adaptive Defense Levelsfeature (Safe, Moderate, Aggressive, Under Attack profile), which is able to dynamically adjust fail2ban mitigation parameters and kernel-level blocking by nftables. The methodology uses a prototype approach that includes needs analysis, architectural design, React.js and Python implementation, and penetration testing. The test dataset was generated from a controlled attack simulation using the Hydra program for brute-force on SSH and ftp services, as well as Nmap for port scanning. The results of the study showed that the system effectively detected and blocked all the IP addresses of the attacker. The blocking response time was recorded at1,030 seconds for SSH, 0.301 seconds for FTP, and 0.492 seconds for port scanning, with an average increase in CPU resources of 2.8%–6.1% and RAM resources of 49.5%.