RuleEngine Firewall & Guard

Overview

RuleEngine is an intelligent firewall orchestration and security automation layer built into One-Click. Rather than requiring administrators to manually craft complex net-filter rules, RuleEngine parses natural-language inputs, abstracts underlying net-filter backends (iptables, ip6tables, and nftables), prevents rule duplication, and enforces safety bounds around core infrastructure services.

It features an integrated Guard & IDS System that monitors active socket connections, correlates SSH brute-force attempts, interfaces with Fail2Ban and AbuseIPDB, and tracks global ban states across the host.

State Lifecycle & Backups

RuleEngine maintains state snapshots before executing disruptive modifications. System state backups are timestamped and preserved under /etc/one-click/rule-engine/.

Lifecycle Management Commands
# Backup current active firewall ruleset
one-click engine backup

# Interactive restore from existing rule snapshots
one-click engine restore

# Safely purge historical firewall backups
one-click engine 'delete firewall'

# Deduplicate active ruleset (retains single instance of repeated rules)
one-click engine 'clean duplicates'

Alias System

Aliases group multiple IPv4, IPv6, or subnet ranges into named logical identifiers. When referenced in access control policies, RuleEngine automatically expands the alias into parallel firewall rules.

Automatic Alias Resolution

Updating an alias automatically affects all firewall rules referencing that identifier, eliminating the need to modify individual net-filter entries.

Alias Management Commands
# Display all active alias mappings
one-click engine 'view alias'

# Create named IP group
one-click engine 'alias-create office 1.2.3.4 1.2.3.5 1.2.3.6'

# Append additional IP addresses to an existing alias
one-click engine 'alias-append office 5.4.3.2 10.0.0.12'

# Prune specific IP address from an alias
one-click engine 'alias-prune office 1.2.3.5'

# Apply firewall policy using an alias target
one-click engine 'allow ssh from office'

Named Ports & Sensitive Port Safety

RuleEngine maps natural service names (e.g., ssh, mysql, nginx, wireguard) to their corresponding TCP/UDP ports automatically.

Core Sensitive Port Protection

Critical infrastructure ports (such as SSH on 22, MySQL on 3306, HTTP/HTTPS on 80/443) are registered as Sensitive Ports. Restrictive actions (DROP, REJECT, DELETE) targeting sensitive ports trigger critical warnings to prevent accidental administrator lockout.

Named & Sensitive Port Commands
# View current sensitive ports list
one-click engine 'sensitive-list'

# Register custom port to sensitive protection list
one-click engine 'sensitive: 21'

# Remove port from sensitive protection list
one-click engine 'sensitive-remove: 21'

# Apply service-based traffic rules
one-click engine 'allow ssh'
one-click engine 'drop mysql'
one-click engine 'reject smtp'

Raw Execution & Command Chaining

Advanced administrators can pass low-level net-filter directives directly to iptables or ip6tables using the raw: prefix. Raw commands bypass natural language translation while maintaining duplication checks.

Strict Chaining Syntax Rules

When chaining commands with commas or 'and', exact spacing rules apply. Improper spacing will cause the parser to fall back to natural language evaluation.

Raw & Command Chaining Examples
# Raw iptables execution
one-click engine 'raw: iptables -A INPUT -p tcp --dport 22 -j ACCEPT'

# Command chaining using comma (No space allowed after comma before raw:)
one-click engine 'raw: iptables -A INPUT -p tcp --dport 22 -j ACCEPT,raw: iptables -L'

# Command chaining using 'and'
one-click engine 'allow ssh from office and allow https'
one-click engine 'raw: iptables -A INPUT -p tcp --dport 22 -j ACCEPT and raw: iptables -L'

Intrusion Detection System (IDS) & Guard

RuleEngine Guard provides real-time threat detection, socket intelligence, Fail2Ban synchronization, and automated IP reputation auditing via AbuseIPDB.

Audit Command Scope & Function
audit Deep Traffic Intelligence: Shows active connections, listening services, and traverses live iptables / nftables rulesets.
audit ssh Renders SSH brute-force metrics, attack attempt counters, and target account IDs.
audit banlist Displays unified global ban list combining RuleEngine Guard drops and active Fail2Ban jail blocks.
audit lookup <IP> Queries AbuseIPDB API to display source country, usage type, and abuse confidence score.
audit scan [--deep|--remediate] Executes system binary and filesystem integrity analysis.
Audit & Threat Mitigation Examples
# Store AbuseIPDB API key securely (AES-256 encrypted at rest)
one-click engine 'audit key YOUR_ABUSEIPDB_API_KEY'

# Perform deep traffic intelligence inspection
one-click engine audit

# Inspect SSH brute-force attempts
one-click engine 'audit ssh'

# Query IP reputation via AbuseIPDB
one-click engine 'audit lookup 1.2.3.4'

# View unified global banlist
one-click engine 'audit banlist'

# Attack Mitigation: Temporarily block attack ID for 1 hour (3600s)
one-click engine 'audit block 12'

# Attack Mitigation: Block attack ID for custom duration (300 seconds)
one-click engine 'audit block 12 dur=300'

# Attack Mitigation: Permanently ban attacker ID
one-click engine 'audit block 12 perm'

# Remove block from target attack ID
one-click engine 'audit unblock 12'

Dry Run & Safety Mode

RuleEngine supports dry-run evaluation allowing administrators to simulate policy modifications prior to committing changes to the active kernel ruleset.

Dry Run Command Simulation
# Simulate rule without affecting active firewall
one-click engine --dry-run "open https"
one-click engine --dry-run "drop ssh from 10.0.0.5"