DEV Community

Thesius Code
Thesius Code

Posted on • Originally published at datanest-stores.pages.dev

Network Security Toolkit

#security #cybersecurity #devsecops #cloud

Network Security Toolkit

A production-grade collection of firewall rule sets, IDS/IPS configurations, network segmentation blueprints, VPN setup scripts, and traffic analysis tools for hardening enterprise networks. This toolkit gives you battle-tested iptables/nftables rules, Suricata detection signatures, VLAN architecture patterns, and Python-based packet analysis scripts — everything needed to build defense-in-depth from the network layer up.

Key Features

  • Firewall Rule Generator — Python scripts that produce hardened iptables/nftables rulesets from YAML zone definitions with logging, anti-spoofing, and stateful tracking.
  • IDS/IPS Signatures — Custom Suricata rules for detecting lateral movement, C2 beaconing, DNS tunneling, and data exfiltration.
  • Network Segmentation Blueprints — VLAN architecture templates for DMZ, internal, management, and IoT zones with inter-zone policies.
  • VPN Configuration Pack — WireGuard and IPsec/IKEv2 generators for site-to-site and remote access VPNs.
  • Traffic Analysis Scripts — Python tools for parsing pcap files, detecting anomalous traffic, and identifying beaconing patterns.
  • Hardening Checklists — Device-specific hardening guides following CIS benchmarks.

Quick Start 

# Extract the toolkit
unzip network-security-toolkit.zip
cd network-security-toolkit/

# Generate firewall rules from your zone definitions
python3 scripts/firewall_generator.py --zones configs/zones.yaml --output iptables_rules.sh

# Deploy IDS rules to Suricata
cp rules/custom_detection.rules /etc/suricata/rules/
suricata -T -c /etc/suricata/suricata.yaml  # Test config

# Analyze a packet capture for anomalies
python3 scripts/traffic_analyzer.py --pcap capture.pcap --output report.json
Enter fullscreen mode Exit fullscreen mode

Firewall Zone Definition 

zones:
  dmz:
    interface: eth0
    subnet: "10.0.1.0/24"
    description: "Public-facing services"
    allowed_inbound:
      - { port: 443, proto: tcp, source: "0.0.0.0/0" }
      - { port: 80, proto: tcp, source: "0.0.0.0/0" }
    allowed_outbound:
      - { port: 443, proto: tcp, dest: "0.0.0.0/0" }
      - { port: 53, proto: udp, dest: "10.0.3.10/32" }

  internal:
    interface: eth1
    subnet: "10.0.2.0/24"
    description: "Internal workstations"
    allowed_inbound:
      - { port: 22, proto: tcp, source: "10.0.3.0/24" }  # SSH from mgmt only
    allowed_outbound:
      - { port: 443, proto: tcp, dest: "0.0.0.0/0" }

  management:
    interface: eth2
    subnet: "10.0.3.0/24"
    description: "Network management"
    allowed_outbound:
      - { port: 22, proto: tcp, dest: "10.0.0.0/8" }
Enter fullscreen mode Exit fullscreen mode

Architecture / How It Works 

                    Internet
                       │
                  ┌────▼────┐
                  │ Firewall │ ◄── iptables/nftables rules
                  └────┬────┘
                       │
            ┌──────────┼──────────┐
            ▼          ▼          ▼
        ┌──────┐  ┌────────┐  ┌──────┐
        │ DMZ  │  │Internal│  │ Mgmt │
        │Zone  │  │  Zone  │  │ Zone │
        └──┬───┘  └───┬────┘  └──┬───┘
           │          │          │
           └──────┬───┘          │
                  ▼              ▼
            ┌──────────┐   ┌──────────┐
            │ IDS/IPS  │   │ Traffic  │
            │ Suricata │   │ Analyzer │
            └──────────┘   └──────────┘
Enter fullscreen mode Exit fullscreen mode

Each zone has explicit ingress/egress policies. Traffic between zones passes through the firewall with IDS inspection.

Usage Examples

IPtables Rule Generator 

import logging
from typing import Any

logger = logging.getLogger(__name__)

def generate_iptables_rules(zones: dict[str, Any]) -> list[str]:
    """Generate iptables rules from zone definitions."""
    rules = [
        "#!/usr/bin/env bash", "set -euo pipefail", "",
        "iptables -F && iptables -X && iptables -t nat -F", "",
        "iptables -P INPUT DROP", "iptables -P FORWARD DROP", "iptables -P OUTPUT DROP", "",
        "iptables -A INPUT -i lo -j ACCEPT",
        "iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT",
        "iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT",
        "iptables -A INPUT -s 127.0.0.0/8 ! -i lo -j DROP", "",
    ]
    for zone_name, cfg in zones.items():
        iface = cfg["interface"]
        rules.append(f"# === Zone: {zone_name} ===")
        for r in cfg.get("allowed_inbound", []):
            rules.append(f"iptables -A INPUT -i {iface} -p {r['proto']} -s {r['source']} --dport {r['port']} -j ACCEPT")
        for r in cfg.get("allowed_outbound", []):
            rules.append(f"iptables -A OUTPUT -o {iface} -p {r['proto']} -d {r['dest']} --dport {r['port']} -j ACCEPT")
    rules.append('iptables -A INPUT -j LOG --log-prefix "[FW-DROP] "')
    rules.append("iptables -A INPUT -j DROP")
    return rules
Enter fullscreen mode Exit fullscreen mode

Suricata Custom Detection Rules 

# rules/custom_detection.rules
# Detect DNS tunneling — unusually long DNS queries
alert dns any any -> any any (msg:"Possible DNS tunneling"; dns.query; content:"."; offset:50; sid:1000001; rev:1;)

# Detect C2 beaconing — regular interval HTTP callbacks
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Possible C2 beacon"; flow:to_server,established; \
  threshold:type both, track by_src, count 10, seconds 600; sid:1000002; rev:1;)

# Detect lateral movement — internal SMB scanning
alert tcp $HOME_NET any -> $HOME_NET 445 (msg:"Internal SMB scan"; flags:S; \
  threshold:type threshold, track by_src, count 5, seconds 30; sid:1000003; rev:1;)
Enter fullscreen mode Exit fullscreen mode

Configuration

Parameter Default Description
firewall.default_policy DROP Default chain policy (DROP recommended)
firewall.log_dropped true Log packets hitting default DROP rule
firewall.rate_limit_icmp 5/sec ICMP rate limiting threshold
ids.home_net 10.0.0.0/8 Suricata HOME_NET definition
ids.rule_reload_interval 3600 Seconds between rule reloads
vpn.wireguard_port 51820 WireGuard listen port
vpn.keepalive_interval 25 Persistent keepalive in seconds
analysis.beacon_threshold 10 Min callbacks in window to flag beaconing

Best Practices

  1. Default deny everything — Start with DROP on all chains. Whitelist only what is needed.
  2. Segment aggressively — Separate VLANs for IoT, servers, workstations. Lateral movement is the attacker's best friend.
  3. Log before you drop — Always add a LOG rule before the final DROP.
  4. Test rules in staging — A bad firewall rule can lock you out. Validate in a mirror environment.
  5. Rotate VPN keys quarterly — Automate WireGuard key rotation with the included scripts.

Troubleshooting

Problem Cause Fix
Locked out after applying rules SSH rule missing or wrong interface Always include a cron job to flush rules after 5 min: at now + 5 min <<< "iptables -F"
Suricata not detecting traffic Interface not in promiscuous mode Run ip link set eth0 promisc on or check af-packet config
VPN peers can't connect Firewall blocking UDP on WireGuard port Add explicit allow rule for UDP port 51820 on WAN interface
Traffic analyzer shows no flows Pcap file uses unsupported encapsulation Convert with editcap -T ether capture.pcap clean.pcap

This is 1 of 9 resources in the Security Engineer Pro toolkit. Get the complete [Network Security Toolkit] with all files, templates, and documentation for $39.

Get the Full Kit →

Or grab the entire Security Engineer Pro bundle (9 products) for $119 — save 30%.

Get the Complete Bundle →

Related Articles

Top comments (0)