webmin-rich-rules
Webmin manages your firewall, except for the parts that matter. This is the module that fixes that, with first-class fail2ban awareness baked in.
Overview
The interesting firewalld features all live in rich rules: source filtering, conditional matching, audit, logging, masquerade, port forwarding. Webmin’s stock firewall module pretends those features do not exist. If you want to use them through a UI, your options are a hand-rolled CLI workflow or somebody else’s half-finished script. I needed the third option, so I wrote it.
The module gives you a forms-driven interface that builds and validates the full rich rule syntax with live preview, recognises fail2ban-generated rules automatically, and lets you unban an IP with one click instead of a fail2ban-client invocation in another window. It is packaged as a .wbm.gz for installation through Webmin’s standard mechanism, runs on production systems, and respects the conventions Webmin has used since the 1990s. Nothing flashy. Nothing that fights the framework. Just the part of firewalld management Webmin should have shipped already.
Technical
The module is Perl with the standard Webmin CGI structure (index.cgi, edit.cgi, save.cgi, delete.cgi, clone.cgi, bulk_actions.cgi, info.cgi) plus a shared library (firewalld-rich-lib.pl) for the rule parsing, rendering, and validation logic. Form rendering uses progressive JavaScript enhancements layered on top of plain CGI, in keeping with how Webmin itself works.
Features that distinguish it from the generic Webmin firewall offering:
- Conditional forms that adapt based on rule type, with live preview of the generated rich rule syntax as you type
- IP, port-range, and protocol validation, plus conflict detection across the existing rule set
- Filtering across IP/network, port, protocol, service, action, and source as discrete fields, not a free-text search
- Automatic rule classification as Admin, fail2ban, or Unknown, with colour-coded markers ([ADM], [F2B], [UNK])
- Direct fail2ban integration: unban an IP via
fail2ban-clientfrom the rule view, see jail status and WHOIS context inline - Bulk operations (multi-select delete and clone) with form-pre-population for cloning
- Tested against rule sets above 1,000 entries so the table behaves on production firewalls
A separate CHANGELOG.md in the repo root documents the bug fixes between the original generated scaffold and the working production version, including specific Webmin environment quirks (for example, &has_command() not reliably finding firewall-cmd, replaced with a direct which system call).
Why You Should Care
A lot of the ops world still runs on tools that predate the cloud. firewalld is current; the framework I plugged into to manage it is older than most developers I know. Working inside Webmin means respecting its conventions, not pretending you are building a 2026 SPA on top of CGI. The module ships because I built within the existing system instead of fighting it. That is the difference between a plugin that lasts and one that gets ripped out the next time someone upgrades.
The technical surface is broader than it looks. firewalld rich rule syntax with all of its conditionals, fail2ban jail state and unban semantics, network-layer IP and port validation, conflict detection across an existing rule set, table performance above a thousand entries, automated .wbm.gz packaging deployed from a build host distinct from the target. None of that is glamorous. All of it is what production sysadmin actually looks like.
The CHANGELOG is also worth reading. It documents what went wrong between the initial scaffold and the working production version, not just the happy-path feature list. The kind of running engineering record a teammate inheriting the code actually needs.
Status
Original work, not a fork. Versioned and packaged for Webmin installation. Deployed and in use.