Listen to this Post
Introduction:
Firewall rule management remains one of the most cumbersome yet critical tasks in network security. Manually auditing complex rule sets for compliance and clarity is error-prone and time-consuming. A new open-source Python script bridges this gap by automatically converting OPNsense firewall configurations into navigable visual graphs and PDF reports, directly integrating with GRC platforms like CISO Assistant for continuous compliance monitoring.
Learning Objectives:
- Understand how to automate the extraction and visualization of OPNsense firewall rules.
- Learn to generate navigable PDF audit reports from raw firewall XML configurations.
- Integrate automated firewall audit outputs into a Governance, Risk, and Compliance (GRC) platform as verifiable evidence.
You Should Know:
1. The Foundation: Parsing OPNsense XML Configuration
The core of this automation lies in parsing the OPNsense XML configuration file. Unlike simpler formats, OPNsense’s structure requires precise navigation to extract rules, interfaces, and associated metadata.
Step-by-step guide explaining what this does and how to use it.
Step 1: Locate the Configuration File. The primary configuration is typically found at `/conf/config.xml` on the OPNsense appliance. This file contains the entire system configuration, including all firewall rules.
Step 2: Parse with Python’s xml.etree.ElementTree. This standard library module is ideal for navigating the XML tree structure.
import xml.etree.ElementTree as ET
tree = ET.parse('config.xml') Or use ET.fromstring(xml_string)
root = tree.getroot()
Navigate to the firewall rules section
for rule in root.findall('./firewall/filter/rule'):
description = rule.find('descr').text
source = rule.find('source').get('any') or rule.find('source/network').text
destination = rule.find('destination').get('any') or rule.find('destination/network').text
protocol = rule.find('protocol').text
... Extract other relevant fields like interface, port, etc.
print(f"Rule: {description}, Source: {source}, Dest: {destination}, Proto: {protocol}")
Step 3: Data Structuring. Store the extracted data in a structured format like a list of dictionaries or a Pandas DataFrame for subsequent processing and visualization.
- Visualization Engine: From Data to Diagrams with Graphviz
Raw data is transformed into intuitive diagrams using Graphviz, a powerful graph visualization software. The Python script generates a DOT language file, which Graphviz renders into a visual representation of network flows.
Step-by-step guide explaining what this does and how to use it.
Step 1: Install Graphviz. Ensure the `graphviz` package is installed on your system and the Python wrapper.
Linux (Debian/Ubuntu): `sudo apt-get install graphviz`
Python Library: `pip install graphviz`
Step 2: Create a Digraph Object. Initialize a directed graph in your Python script.
from graphviz import Digraph dot = Digraph(comment='OPNsense Firewall Rules') dot.attr(rankdir='LR') Left-to-right graph orientation
Step 3: Define Nodes and Edges. Represent network objects (subnets, hosts) as nodes and firewall rules as edges connecting them.
Add a source node
dot.node('NET_192.168.1.0', 'Internal LAN\n192.168.1.0/24', shape='rectangle')
Add a destination node
dot.node('NET_8.8.8.8', 'Google DNS\n8.8.8.8', shape='ellipse')
Add an edge representing the firewall rule allowing the traffic
dot.edge('NET_192.168.1.0', 'NET_8.8.8.8', label='Allow DNS\n(UDP/53)')
Step 4: Render the Graph. Output the graph to a file. While the original post moved from PNG to PDF, you can generate various formats.
Renders a PDF file named 'firewall_rules.pdf'
dot.render('firewall_rules', format='pdf', cleanup=True)
3. Advanced Reporting: Generating a Navigable PDF
A single PNG is insufficient for complex rule sets. The script’s evolution to generating a multi-page, navigable PDF is a significant enhancement, allowing for bookmarks and hyperlinks between related rules or sections.
Step-by-step guide explaining what this does and how to use it.
Step 1: Use a PDF Library. Employ a library like `reportlab` to create sophisticated PDFs programmatically.
`pip install reportlab`
Step 2: Create a PDF Canvas and Add Content. Structure the PDF with titles, headings, and the generated images.
from reportlab.pdfgen import canvas
from reportlab.lib.pagesizes import letter
c = canvas.Canvas("firewall_audit_report.pdf", pagesize=letter)
c.setFont("Helvetica-Bold", 16)
c.drawString(100, 750, "OPNsense Firewall Audit Report")
Add a generated graph image
c.drawImage("rule_graph_1.png", 50, 500, width=500, height=200)
c.showPage()
c.save()
Step 3: Integrate with Graphviz Output. The script likely orchestrates the generation of multiple graphs (e.g., per-interface) and collates them into a single, cohesive PDF document.
- GRC Integration: Linking Evidence with CISO Assistant API
The true power for CISOs is the direct integration with GRC tools. The script uses the CISO Assistant API to attach the generated PDF as evidence to a specific control or requirement, automating the compliance evidence collection process.
Step-by-step guide explaining what this does and how to use it.
Step 1: Authenticate with the GRC API. Obtain an API key from your CISO Assistant instance and use it for authenticated requests.
Step 2: Use the `evidences` Endpoint. The CISO Assistant API provides an endpoint to upload and link evidence files.
Example using curl to upload an evidence file curl -X POST https://your-ciso-assistant-domain/api/evidences \ -H "Authorization: Bearer YOUR_API_TOKEN" \ -F "file=@firewall_audit_report.pdf" \ -F "requirement_id=SEC-404" \ -F "description='Automated OPNsense Firewall Rule Audit - $(date)'"
Step 3: Revision Management. As noted in the comments, instead of creating new evidence for every run, it’s better to submit a revision to the existing evidence, maintaining a clean audit trail. The script was updated to implement this best practice.
5. Overcoming OPNsense Complexities
The post mentions that OPNsense was “more complicated than pfSense.” This likely refers to differences in the XML schema, rule organization, or the handling of advanced features. The Python script had to be meticulously adapted to correctly interpret these OPNsense-specific structures, such as alias references, rule categories, and interface assignments.
6. Script Maintenance and Improvement
The author acknowledges the code’s initial state and welcomes feedback, a common practice in open-source development. This includes refactoring for readability, adding error handling, and exploring new features like automatic rule anomaly detection (e.g., finding overly permissive “ANY/ANY” rules) or dependency mapping.
What Undercode Say:
- Automation is Non-Negotiable for Modern Compliance: Manual firewall audits are obsolete. This tool demonstrates that continuous, automated technical control validation is achievable and must be integrated into the security lifecycle.
- Bridging the Technical-GRC Chasm: The direct API integration with CISO Assistant is a blueprint for the future, closing the loop between technical implementation and managerial compliance reporting. It turns a technical artifact (a config file) into a business asset (audit evidence).
The development of this script highlights a critical trend in cybersecurity: the rise of bespoke automation to solve specific operational pain points. While commercial tools exist, they often lack flexibility or come with a high cost. This Python-based approach offers a tailored, cost-effective, and highly adaptable solution. It empowers security teams to build their own auditing and reporting pipelines, ensuring that compliance is a byproduct of normal operations rather than a disruptive, periodic event. The move from static PNGs to a navigable PDF and the focus on GRC integration show a deep understanding of the end-to-end compliance workflow, not just the technical parsing problem.
Prediction:
The methodology demonstrated here will become standard practice within three years. We will see a proliferation of open-source, API-driven tools that automatically extract configuration data from all critical infrastructure components—firewalls, cloud security groups, IAM policies—and push validated, formatted evidence directly into GRC platforms. This will enable real-time compliance dashboards and fundamentally shift audits from point-in-time assessments to continuous verification processes. AI will further enhance this by automatically analyzing the generated graphs and reports to suggest optimizations, detect misconfigurations, and predict potential compliance gaps before they occur.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Olivier Bro – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
