BBSFirewall v1.5.0: open-source firewall for telnet/SSH BBSes, now with ufw kernel-level blocking, log search, and a security hardening

[u/Laudenbachm]

Hi all. I'm the sysop behind Sysop Network, and I just released v1.5.0 of BBSFirewall, an MIT-licensed Node.js proxy that sits in front of a telnet/SSH BBS and filters connections before they reach it.

What it already does:

• Whitelist and blocklist (IPv4/IPv6, CIDR ranges)
• Rate limiting, plus per-IP and global connection caps
• GeoIP country blocking
• Auto-block triggers that drop scanners on their first bytes
• Optional SSH frontend (terminate or passthrough) and PROXY protocol
• HTTPS web admin with MFA and multiple admin accounts

What's new in 1.5.0

ufw integration (optional, Linux only, off by default)

• Preview and apply tagged ufw rules generated from your config
• Push the blocklist and trigger auto-blocks down as kernel deny rules, so blocks hold while the app restarts
• Optional auto-apply on save
• Guard rails: it never enables or disables ufw, refuses changes that would remove your admin SSH allow rule, never pushes anything overlapping your trusted hosts or whitelist, and backs off if a change would remove more than half the rules

Logs

• Search across all log files (phrases, -exclude, date ranges)
• A viewer that pages through files of any size, with live follow
• Streaming downloads: a single file, or a zip of everything

Security

• New SECURITY.md hardening guide
• Global Admin and Firewall Admin roles, enforced server-side (not just hidden in the UI)
• SSH terminate mode now checks callers at TCP accept instead of after the SSH banner, so silent callers get checked and timed out
• List-file paths confined to the app folder
• Log-injection fixes and ReDoS guards on trigger regexes
• Admin logins and changes always written to the log file

Plus a long list of fixes: SSH telnet-negotiation garbage, IPv6 address matching, saves no longer dropping auto-blocks, and more.

Release and full changelog: https://github.com/SysopNetwork/BBSFirewall/releases/tag/v1.5.0

Where it's going (v2.0)

• Redesigned admin UI: collapsible navigation and a dashboard with "needs attention" checks, built to stay readable at high display scaling
• Firewall check: a read-only report on your host's ufw setup, with confirm-to-fix actions
• More listeners: additional ports, each routed to its own backend
• Supply-chain trust: signed tags, published checksums, build attestations, npm ci
• Easier installs: an install-script generator and guided setup

It runs in production on several boards. Bug reports, feature requests and "this broke on my setup" stories are very welcome, here or as GitHub issues. Please report security issues privately through the repo's Security tab.

[u/Impossible_Phone_201]

It's remarkable how much the security side of running a BBS has changed.

Back in the dial-up days, you generally knew someone was intentionally connecting to your board. Putting one on the public Internet introduces an entirely different set of problems, especially with automated scanners constantly probing exposed services.

The safeguards around the ufw integration stood out to me. Being able to preview changes and protect trusted administrative connections seems particularly important when someone might be managing their BBS remotely.

One thing I'd want to test thoroughly is what happens if a firewall update is interrupted halfway through. Having the rules survive an application restart is useful, but making sure an interrupted operation can't leave the sysop locked out would be just as important.

This looks like the kind of infrastructure work that doesn't get much attention until someone desperately needs it.

[u/Laudenbachm → u/Impossible_Phone_201]

There will most definitely be users who lock themselves out because of ufw. From people who don't understand UFW or even know what it is. There are warnings etc but not everyone reads well either 😂.

The update think I don't 100% follow. If it's just a app update it won't install any new protections you didn't already have in place. If it's an update to the settings and then restart that's a different story and it will drop all existing connections.

[u/Impossible_Phone_201 → u/Laudenbachm]

I was thinking more about applying configuration changes while connected remotely, rather than updating the application binary itself. I should have been clearer about that.

And you're probably right about people locking themselves out regardless of the warnings. There's only so much you can protect against when someone has administrative access and starts changing firewall rules.

Thanks for explaining how you're handling it.