Hi all. I'm the sysop behind Sysop Network, and I just released v1.5.0 of BBSFirewall, an MIT-licensed Node.js proxy that sits in front of a telnet/SSH BBS and filters connections before they reach it.
What it already does: Whitelist and blocklist (IPv4/IPv6, CIDR ranges) Rate limiting, plus per-IP and global connection caps GeoIP country blocking Auto-block triggers that drop scanners on their first bytes Optional SSH frontend (terminate or passthrough) and PROXY protocol HTTPS web admin with MFA and multiple admin accounts What's new in 1.5.0
ufw integration (optional, Linux only, off by default) Preview and apply tagged ufw rules generated from your config Push the blocklist and trigger auto-blocks down as kernel deny rules, so blocks hold while the app restarts Optional auto-apply on save Guard rails: it never enables or disables ufw, refuses changes that would remove your admin SSH allow rule, never pushes anything overlapping your trusted hosts or whitelist, and backs off if a change would remove more than half the rules
Logs Search across all log files (phrases, -exclude, date ranges) A viewer that pages through files of any size, with live follow Streaming downloads: a single file, or a zip of everything
Security New SECURITY.md hardening guide Global Admin and Firewall Admin roles, enforced server-side (not just hidden in the UI) SSH terminate mode now checks callers at TCP accept instead of after the SSH banner, so silent callers get checked and timed out List-file paths confined to the app folder Log-injection fixes and ReDoS guards on trigger regexes Admin logins and changes always written to the log file
Plus a long list of fixes: SSH telnet-negotiation garbage, IPv6 address matching, saves no longer dropping auto-blocks, and more.
Release and full changelog: https://github.com/SysopNetwork/BBSFirewall/releases/tag/v1.5.0 Where it's going (v2.0) Redesigned admin UI: collapsible navigation and a dashboard with "needs attention" checks, built to stay readable at high display scaling Firewall check: a read-only report on your host's ufw setup, with confirm-to-fix actions More listeners: additional ports, each routed to its own backend Supply-chain trust: signed tags, published checksums, build attestations, npm ci Easier installs: an install-script generator and guided setup
It runs in production on several boards. Bug reports, feature requests and "this broke on my setup" stories are very welcome, here or as GitHub issues. Please report security issues privately through the repo's Security tab. submitted by /u/Laudenbachm [link] [comments]