Fire – Custom LKM firewall passes packets to userland python script.

fire is custom firewall resides in kernel space and userspace Contains 2 components:
+ custom.ko — LKM (linux kernel module)
+ fire.py — Python script (run from user space)
Custom.ko passes ICMP/UDP/TCP packets to fire.py for further inspection and accepts any other package.

Dependency:
+ nfqueue-bindings
+ scapy

Installation & Usage:

git clone https://github.com/vag-makr/fire && cd fire
apt-get update && apt-get install build-essential libnetfilter-queue-dev linux-headers-$(uname -r)
apt-get install python-nfqueue python-scapy
cd LKM
make

Load custom.ko:
insmod custom.ko
lsmod | grep custom
tail -f /var/log/kern.log

Unload custom.ko:
rmmod custom.ko
dmesg

python fire.py (make sure to load custom.ko)

Source : https://github.com/vag-makr