SxWall (ScalarX Wall)
SxWall is a GPL-licensed Bash script designed to manage a local Linux firewall based on ipset + iptables/ip6tables. It is being deployed in production on the StackX servers at ScalarX.
SxWall replaces a collection of scripts that I often wrote on the fly to meet immediate needs (whoas.sh, asiplist.sh, countryblock.sh, blacklist.sh, unblacklist.sh, brainfw.sh, etc.) with one more robust, more efficient tool.
The principle is deliberately simple: iptables stays minimal (a few stable rules), while all the bulk (large country/ASN IP/CIDR lists, manual blocks, whitelist, blacklists) lives in ipset sets. The result: constant performance even with very large lists.
Main features
– Reinforced protection against concurrent runs (lockfile + flock) to prevent duplicate execution.
– Execution logged in /var/log/sxwall/.
Management of dedicated ipset sets:
– IPv4/IPv6 whitelist (ALLOW)
– IPv4/IPv6 master (list:set : aggregation of subsets)
– IPv4/IPv6 manual (manual blocks, always included in master)
IPv4/IPv6 predef blacklist (predefined blacklists, always included in master)
Injection of iptables/ip6tables rules through a dedicated SXWALL chain, with whitelist priority followed by master drop.
Blocking multiple target types:
– IP or CIDR (manual block).
– Country (ISO2 code, e.g. fr).
– Region (AF/AS/EU/NA/SA/OC/AN).
– ASN.
– Fast bulk import of IPs/CIDRs from a file or stdin.
External blacklists/whitelists:
– Automatically loads an additional whitelist from a configurable directory (/etc/sxwall/whitelist.d by default).
– Automatically loads predefined blacklists from a configurable directory (/etc/sxwall/blacklist.d by default).
Updating sources:
– Countries/regions through IPdeny (aggregated IPv4 + IPv6).
– ASNs through whois.radb.net (IRR: route/route6), with IPv4 merging if iprange is present.
– Supports forced updates of an ASN.
Checks and diagnostics:
– IP check: whitelist, manual, predef blacklist, then a search for matching subsets.
– Country/ASN check: presence of sets, attachment to master, entry count, presence of the zonefile.
– Region check: list of active countries.
Backup/restore:
– Backup through ipset save
– Restore through ipset restore (supports latest)
Consistent semantics: after a restore, SxWall reapplies the local whitelist/blacklist, then reinjects the rules.
Technical architecture
iptables/ip6tables:
O(1) matching against ipset, no bulky rulesets.
ipset:
– Master uses list:set to dynamically aggregate subsets (country/ASN + manual + predef)
– Subsets use hash:net (supports IPs and CIDRs)
Subset updates (country/ASN):
– Load into a temporary set through ipset restore
– Atomic swap
– Destroy the temporary set
Self-correction: if a set exists with the wrong type, destroy/recreate it after runtime cleanup (removing iptables references).
Usage
The StackX machines load a standard iptables rules file (/etc/iptables.rules) at startup (allowed ports/services). I added two entries to it:
01:45:35-root@brain-prd:~$ grep SXWALL /etc/iptables.rules
:SXWALL - [0:0]
-A INPUT -j SXWALL
Initialisation:
sxwall start
Reload the local whitelist/blacklist and reinject rules (without restore):
sxwall reload
Update the databases (countries + cached ASNs):
sxwall update
Force an ASN update:
sxwall update asn AS209474
Block:
sxwall block 1.2.3.4
sxwall block 1.2.3.0/24
sxwall block fr
sxwall block EU
sxwall block AS209474
Unblock:
sxwall unblock 1.2.3.4
sxwall unblock fr
sxwall unblock EU
sxwall unblock AS209474
Import a batch of IPs/CIDRs:
sxwall import /path/to/list.txt
Import from stdin:
xxxxxxx | sxwall import -
Unblock the imported batch (clear then import):
sxwall import /path/to/list.txt --clear
Check a target’s status:
sxwall check 1.2.3.4
sxwall check 1.2.3.0/24
sxwall check fr
sxwall check EU
sxwall check AS209474
List the active configuration:
sxwall list
Back up / restore:
sxwall save
sxwall restore latest
sxwall restore sxwall.conf-2025-12-31-01-51
Identify an IP’s ASN:
sxwall whoas 1.2.3.4
Note: the script must be run with root privileges.
Design notes
SxWall is designed to run on StackX and is therefore optimised for our needs and internal processes (fleet, support team, manual or automated execution, protection against concurrent runs, and systematic logging).
The ipset model (list:set + hash:net) makes it possible to maintain massive lists without degrading iptables performance. The script favours an operational, reproducible approach:
– Simple country sources (IPdeny) for quick geographical blocks.
– IRR-based ASN sources (RADB) for pragmatic “network” blocks.
– Explicit checks to understand why an IP is blocked (whitelist vs manual vs predef vs country/ASN).
– conf.d directories to make the firewall operable (adding a rule = dropping in a file, then reloading).
Todo list
– Atomic whitelist updates (tmp + swap) to avoid any window where the whitelist is empty.
– Atomic iptables injection (iptables-restore / chain swap) to avoid an empty-chain window during refresh.
– Cache/TTL for country/region downloads (avoid downloading again unnecessarily).
– ASN source from an internal cache server (fed by bgpq4/IRRtoolset/routeviews), retaining the current source as a fallback.
– Slightly “sexier” cosmetics.
Resources
Script: sxwall.sh
—
Christophe Casalegno (find all my social networks at: all.bo)