nveLSAM - Network Configuration & Firewall Management

Portfolio Project - This repository is shared for demonstration and portfolio purposes. All rights reserved.

An Erlang application that runs on network edge devices and manages routing, TUN interfaces, packet forwarding, and firewall rules for SD-WAN infrastructure.

🎯 Project Overview

This application was developed as part of a commercial SD-WAN solution. It works together with tunnel management components under an umbrella application architecture.

Key Responsibilities:

• Dynamic routing and forwarding configuration
• iptables-based firewall management with multiple security levels
• WAN interface monitoring and failover
• Enhanced services traffic handling via TUN interfaces
• Integration with central management systems via ZeroMQ

🔧 Technologies & Skills Demonstrated

• Language: Erlang/OTP
• Networking: iptables, routing tables, TUN/TAP interfaces, ICMP monitoring
• Architecture: Supervisor trees, event-driven design, gen_server patterns
• Integration: ZeroMQ messaging, DHCP event handling, JSON configuration
• Tools: rebar3, lager logging

Overview

The application is a part of an SD-WAN project. It works together with aTunnel app under SDW-NVE umbrella application (Erlang).

nveLSAM handles routing, forwarding, firewalling and traffic shaping of LAN and WAN interfaces. It also sets up TUN interfaces to handle Enhanced Services traffic.

The application consists of the following modules:

• lsam_sup – the main supervisor that starts all below modules. It also sets up hooks on DHCP client events, and provides API to restart/reload the application. It starts pinger_sup supervisor.

• evnt_mgr – the event manager gets events from DHCP client and from pinger module. It gets requests from SCM2, pushes them down to netconfig module and sends replies back to SCM2.

• netconfig – this is the core of nveLSAM. It gets network configuration from the system itself and/or reads network configuration from nVE config files (/mnt/config/current/scm/lsam.json). It sets up routing rules and policies, sets up the firewall (iptables), and starts pinger process(es).

• pinger – the process checks the Internet availability over WAN interfaces. It pings a configured host (default is 8.8.8.8) and changes default routing if the host is not reachable, and sends events to SCM2.

• firewall – API that is called from netconfig to build iptables rules based on the firewall configuration section in /mnt/config/current/scm/lsam.json

• mES – the logic of this module provides functionality of Managed Enhanced Services. It sets up TUN interfaces and appropriate routing based on the service definitions in /mnt/config/current/scm/serviceDefinitions.json

Configuration

There are two places from which nveLSAM gets its configuration parameters:

1. sys.config and shell.config default files in config folder. The configuration in shell.config file is used for testing and debugging purposes when the application is started with rebar3 shell command.

2. lsam.json, lsam_interfaces.json, and serviceDefinitions.json. These files are located in nVE common configuration folder /mnt/config/current/scm/. These files are populated by SCM2 and NCM.

Building Process

The application can be compiled and built with common rebar3 tool:

$ rebar3 upgrade – upgrade all dependencies

$ rebar3 compile – compile the application

$ rebar3 as prod tar – build a release and zip it into a tarball file. This action does not make sense, since the application is part of sdw_nve umbrella application and must be released under sdw_nve.

💡 Key Features Implemented

Multi-Level Firewall Security

• Low Level (Default Allow): Permissive mode with selective blocking
• Medium Level (Default Block): Stateful filtering with LAN-to-WAN allowance
• High Level: Strict whitelist-only mode
• Implemented using dynamic iptables rule generation

Intelligent WAN Monitoring

• Active ICMP health checking of multiple WAN interfaces
• Automatic failover on connectivity loss
• Event-based notifications to management systems

Enhanced Services Support

• Dynamic TUN interface creation and management
• Service-specific routing based on JSON definitions
• Integration with managed services infrastructure

📋 Note on Dependencies

This project includes dependencies on private repositories that were part of the original development environment. The code demonstrates the architecture and implementation patterns, though a complete build would require access to those internal libraries.

📄 License

Copyright (c) 2025. All Rights Reserved.
This code is provided for portfolio and demonstration purposes only.
See LICENSE for details.