Connection Guard

Connection Guard is a powerful Python-based Network Intrusion Detection and Prevention System (IDS/IPS) that monitors incoming network connections, detects suspicious activity based on configurable rules and signatures, and automatically blocks malicious traffic.

Features

✨ Real-time Network Monitoring

• Captures and analyzes TCP, UDP, and ICMP traffic
• Tracks connection states and statistics
• Supports promiscuous mode for complete network visibility

🛡️ Advanced Threat Detection

• Port Scan Detection: Identifies reconnaissance attempts
• SYN Flood Detection: Detects DoS attacks
• Signature-based Detection: Pre-defined patterns for:
  • SQL Injection
  • Cross-Site Scripting (XSS)
  • Command Injection
  • Path Traversal
  • And more...

🚫 Automated Blocking

• Integrates with Windows Firewall and Linux iptables
• Temporary or permanent IP blocking
• Auto-expiry for temporary blocks
• Whitelist support to protect trusted IPs

📊 Comprehensive Logging & Alerts

• Rotating log files with configurable size limits
• Colorized console output
• File-based alerts
• Detailed threat and connection logging

⚙️ Highly Configurable

• YAML-based configuration files
• Custom rule creation
• Adjustable detection thresholds
• Flexible blocking policies

Requirements

• Python 3.8 or higher
• Administrator/root privileges (required for packet capture and firewall modification)
• Windows or Linux operating system

Installation

1. Clone or download this repository

2. Install dependencies

   pip install -r requirements.txt

3. Configure the tool (optional)

   Edit the configuration files in the config/ directory:

   • config.yaml - Main settings
   • rules.yaml - Security rules
   • whitelist.yaml - Trusted IPs/networks

Usage

Basic Usage

Run Connection Guard with default settings:

Windows (Administrator)

python connection_guard.py

Linux (Root)

sudo python3 connection_guard.py

Command-Line Options

usage: connection_guard.py [-h] [-c CONFIG] [--clear-blocks] [--list-rules]

Connection Guard - Network Security Tool

optional arguments:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        Configuration directory (default: config)
  --clear-blocks        Clear all firewall rules created by Connection Guard
  --list-rules          List all loaded rules and exit

Examples

List all loaded rules:

python connection_guard.py --list-rules

Clear all blocked IPs:

python connection_guard.py --clear-blocks

Use custom configuration directory:

python connection_guard.py -c /path/to/custom/config

Configuration

Main Configuration (config/config.yaml)

# Monitoring settings
monitoring:
  interface: null  # null = monitor all interfaces
  promiscuous_mode: true

# Detection thresholds
thresholds:
  port_scan:
    ports_accessed: 10
    timeframe: 60
  syn_flood:
    syn_packets: 100
    timeframe: 10

# Blocking settings
blocking:
  enabled: true
  default_action: log
  block_duration: 3600  # seconds
  auto_unblock: true

Creating Custom Rules (config/rules.yaml)

Rules support the following criteria:

• name: Unique rule identifier
• action: block, alert, or log
• protocol: TCP, UDP, ICMP, or null for any
• src_ip: Source IP or CIDR notation
• dst_ip: Destination IP or CIDR notation
• src_port: Source port number
• dst_port: Destination port number
• payload_pattern: Regex pattern to match in payload
• priority: Higher values are checked first
• enabled: true or false

Example rule:

rules:
  - name: block_ssh_from_suspicious_network
    action: block
    protocol: TCP
    src_ip: 192.0.2.0/24
    dst_port: 22
    description: Block SSH from suspicious network
    priority: 90
    enabled: true

Whitelist (config/whitelist.yaml)

Protect trusted IPs from being blocked:

whitelist:
  - 127.0.0.1
  - 192.168.0.0/16
  - 10.0.0.0/8

How It Works

1. Packet Capture: Uses Scapy to capture network packets in real-time
2. Analysis: Each packet is analyzed for suspicious patterns
3. Rule Evaluation: Connections are matched against loaded rules
4. Threat Detection: Built-in algorithms detect port scans, SYN floods, and attack signatures
5. Action: Based on matched rules, the system can:
   • Log: Record the event
   • Alert: Generate a notification
   • Block: Add the source IP to the firewall blocklist

Detection Capabilities

Port Scan Detection

Triggers when a single IP attempts to connect to multiple ports within a short timeframe.

SYN Flood Detection

Identifies excessive SYN packets from a single source, indicating a potential DoS attack.

Signature-Based Detection

Matches payload content against known attack patterns:

• SQL Injection attempts
• XSS payloads
• Command injection
• Path traversal
• Malicious user agents

Important Notes

⚠️ Privileges: This tool requires administrator (Windows) or root (Linux) privileges to:

• Capture network packets
• Modify firewall rules

⚠️ Whitelisting: Always add your trusted networks to the whitelist to avoid accidentally blocking legitimate traffic.

⚠️ Testing: Test rules in a safe environment before deploying to production.

⚠️ Performance: Monitoring all network traffic can be resource-intensive on high-traffic systems.

Architecture

connection_guard/
├── connection_guard.py   # Main application
├── monitor/              # Network monitoring
│   ├── connection.py     # Connection data models
│   └── monitor.py        # Packet capture & analysis
├── rules/                # Rule engine
│   ├── rule_engine.py    # Rule matching logic
│   └── signatures.py     # Attack signatures
├── blocker/              # Blocking system
│   └── blocker.py        # Firewall integration
├── utils/                # Utilities
│   ├── logger.py         # Logging system
│   ├── alerts.py         # Alert notifications
│   └── config.py         # Configuration loader
└── config/               # Configuration files
    ├── config.yaml
    ├── rules.yaml
    └── whitelist.yaml

Troubleshooting

"This tool requires administrator/root privileges"

• Run with elevated privileges (sudo on Linux, Run as Administrator on Windows)

"No module named 'scapy'"

• Install dependencies: pip install -r requirements.txt

Cannot capture packets on Windows

• Install Npcap: https://npcap.com/

Blocked legitimate traffic

• Add the IP/network to config/whitelist.yaml
• Clear blocks: python connection_guard.py --clear-blocks

License

MIT License - See LICENSE file for details

Disclaimer

This tool is for educational and authorized security testing purposes only. Always ensure you have permission to monitor and block network traffic on the systems and networks you are working with.

Author

Created by TheExploitLab

---

Stay Protected! 🛡️