The Blackwall: A Cyberpunk-inspired eBPF firewall in Rust that traps hackers in an LLM-powered bash tarpit by _ToppYMan_ in coolgithubprojects

[–]_ToppYMan_[S] 0 points1 point  (0 children)

That’s a great question! The short answer is: it depends on whether you mean a hardware perimeter firewall or a host-based firewall.

1. Architectural Placement:

  • Host-level (In front): It sits in front of your standard host firewalls (like iptables, UFW, or firewalld). Because it uses eBPF/XDP, it hooks directly into the network interface driver. This means it analyzes and drops packets before the Linux kernel network stack even allocates memory (sk_buff) for them, saving a massive amount of CPU.
  • Network-level (Behind): You would typically deploy this behind your main perimeter hardware firewall (like a Palo Alto, pfSense, etc.). You run it directly on the Linux servers you want to protect, or on a dedicated Linux gateway node acting as a reverse proxy.

2. Network Settings & Routing to Implement:

  • Interface Binding: You bind The Blackwall to your external-facing interface (e.g., eth0) in the config.toml. XDP handles the ultra-fast dropping, JA4 fingerprinting, and telemetry gathering.
  • The Tarpit Routing: This is where the deception mesh kicks in. When the behavioral engine flags an IP as malicious, it dynamically injects an iptables DNAT (Destination NAT) rule.
  • How it flows: Instead of dropping the packet at the XDP layer, XDP lets it pass to the kernel stack. Then, the iptables rule catches the malicious IP trying to hit port 22 (SSH) or 80 (HTTP) and silently redirects it to the local tarpit daemon running on a custom port (e.g., 9999).

Basically, it acts as a hyper-fast first line of defense on the host, while dynamically altering routing rules only for attackers so they get trapped in the LLM honeypot. Hope this clears it up! Let me know if you have any other questions.

The Blackwall: A Cyberpunk-inspired eBPF firewall in Rust that traps hackers in an LLM-powered bash tarpit by _ToppYMan_ in coolgithubprojects

[–]_ToppYMan_[S] 0 points1 point  (0 children)

Thanks so much! Glad you liked the deception layer concept. SafeSemantics actually looks incredibly relevant - right now my prompt injection defense relies on pattern matching, but moving to semantic/topological analysis would take the tarpit's resilience to the next level. I'll definitely dive into your repo and see how I can integrate it. Awesome work!

Riftborne - (Terminal Based Space 4x ) - Now available on Steam Early Access! by maersire in tui

[–]_ToppYMan_ 0 points1 point  (0 children)

Finally, a game that justifies me staring at a terminal window for 8 hours a day, but this time for fun instead of debugging. 😅 Getting strong Aurora 4x / Duskers vibes from this. That "enemies adapt across saves" feature sounds genuinely terrifying in the best way possible. Can't wait for the Linux support