Frequently Asked Questions

Frequently Asked Questions

General

What does "Apotropaios" mean?

From Greek apotropaios (ἀποτρόπαιος) — "turning away evil." It refers to rituals or objects used to ward off evil influences. The name reflects the tool's purpose: protecting systems by managing the firewall rules that turn away malicious traffic.

Why another firewall manager?

Each Linux firewall tool (iptables, nftables, firewalld, ufw, ipset) has its own syntax, concepts, and management approach. Apotropaios provides a single interface across all of them, with added features like UUID rule tracking, TTL-based temporary rules, configuration portability, and automated backup/recovery that no individual tool provides.

Does it replace my firewall?

No. Apotropaios is a management layer that sits above your firewall. It generates and executes commands for the underlying firewall tool. Your actual packet filtering is still done by iptables, nftables, or whichever backend you select.

Can I use multiple backends simultaneously?

Yes. Each rule is tagged with the backend it was created through. You can create iptables rules and nftables rules in the same session. The rule index tracks which backend owns each rule for correct removal and management.

What happens to rules if I uninstall Apotropaios?

Rules that were applied to your firewall remain active. Apotropaios manages rules through the standard firewall commands. Uninstalling Apotropaios removes only the management layer and tracking data — not the firewall rules themselves.

Compatibility

Which Linux distributions are supported?

Ubuntu 22.04+, Kali Linux (rolling), Debian 12, Rocky Linux 9, AlmaLinux 9, and Arch Linux.

What bash version is required?

Bash 4.0 or newer. The framework uses associative arrays and other bash 4.0+ features.

Does it work in containers?

The framework runs in containers, but some features may be limited. Container environments often lack systemd (affecting service status detection) and may restrict certain firewall operations depending on container capabilities.

Does it work on WSL?

Partially. OS detection works, but firewall operations may be limited depending on your WSL version and configuration. WSL 2 with a full Linux kernel provides better compatibility.

Rules

How are rules tracked?

Every rule created through Apotropaios receives a UUID (Universally Unique Identifier). The rule's full specification — backend, direction, protocol, IPs, ports, action, timestamps, and state — is stored in a persistent pipe-delimited index file at data/rules/rule_index.dat.

What's the difference between "deactivate" and "remove"?

Deactivate removes the rule from the firewall but keeps the record in the index. You can re-activate it later without re-entering all parameters. Remove deletes the rule from both the firewall and the index permanently.

How do temporary rules work?

Temporary rules have a TTL (time-to-live) in seconds. When the TTL expires, the rule is automatically deactivated (removed from the firewall but retained in the index with state "expired"). In interactive mode, a background monitor checks every 30 seconds and auto-deactivates expired rules. Proactive terminal alerts appear when a rule is within 10 minutes of expiring. Expiry is also checked at framework startup and on every main menu iteration.

Can I extend a temporary rule's timer?

Yes. Use the Rule Expiry Watcher (Rule Management > Option 10) to see all temporary rules and their remaining time. Select "Extend a rule timer" to add additional time. This works even for already-expired rules — they will be re-activated with the new TTL.

How do I import rules from another system?

Export on the source system:

sudo ./apotropaios.sh export /tmp/rules.conf

Copy the file (and its .sha256 sidecar) to the target system, then:

sudo ./apotropaios.sh import /tmp/rules.conf

Can I see rules I didn't create through Apotropaios?

Yes. Rule Management > Option 3 ("List existing System rules") audits all installed firewall backends and displays every currently active rule, including those created manually or by other tools.

Security

Is user input sanitized?

Yes. All user input passes through whitelist validation functions that reject anything not matching predefined safe patterns. Shell metacharacters (;|&\$(){}\<>!#`) are explicitly rejected.

Are passwords logged?

No. The logging subsystem automatically masks sensitive patterns including password, passwd, secret, token, key, apikey, and api_key fields in all log output.

What permissions are set on data files?

All data files (logs, rule index, state, backups) are created with 600 permissions (owner read/write only). Directories use 700 (owner only). The umask is set to 077 at startup.

Backup & Recovery

When are automatic backups created?

Before any destructive operation: reset, block-all, firewall install/update, and restore operations all create automatic restore points labeled with the operation name and timestamp.

What's in a backup?

A compressed tar.gz archive containing the configuration of every installed firewall backend (iptables-save output, nft ruleset, firewalld zone config, ufw status, ipset save), plus the Apotropaios rule index and state files, and a JSON manifest with metadata.

What are immutable snapshots?

Immutable snapshots are backup archives protected with the Linux chattr +i attribute, preventing modification or deletion even by root. They also include SHA-256 checksums for integrity verification. Use these for critical baseline configurations.

What's the difference between --interactive and running with no arguments?

Both launch the interactive menu, but --interactive is the preferred, explicit way to enter menu mode. It enforces mutual exclusivity — you cannot combine --interactive with CLI commands or --non-interactive. Running with no arguments also launches the menu for backward compatibility, but --interactive makes the operational intent clear.

Can I cancel out of the rule creation wizard?

Yes. Type q, quit, cancel, back, or b (case-insensitive) at any prompt during the 5-step wizard. The wizard exits immediately with "Rule creation cancelled." and no partial rule is created. This works at all 29 prompts across all 5 firewall backends, including the final confirmation step.

How do I create rules for non-default firewalld zones?

The rule creation wizard presents a dynamic numbered list of all available zones from firewall-cmd --get-zones, with the default zone highlighted. Select by number or type the zone name. The firewalld Configuration submenu also provides zone-aware queries for services, rich rules, full config, and runtime vs permanent comparison.

Does the framework manage rules across all iptables tables?

Yes. The rule wizard lets you select the table (filter/nat/mangle/raw) and chain. The iptables Configuration submenu provides a table selector for viewing rules in any of the 5 tables (filter/nat/mangle/raw/security), plus a full view of all tables at once.