// master_project :: hybrid_security_framework
A unified security platform combining iptables-based firewall management with WireGuard VPN tunnelling, orchestrated through a Python/Flask backend, RBAC, 2FA, IDS, and a real-time monitoring dashboard.
M.Sc. Capstone Project — Dr. MGR UniversityThe proliferation of cyber threats in modern network environments necessitates robust, multi-layered security architectures combining perimeter defence with encrypted communication channels. SunduVault is a Hybrid Security Framework that seamlessly integrates iptables-based firewall management with WireGuard VPN technology, orchestrated through a PHP/Flask backend and a real-time monitoring dashboard.
The framework enforces network access control through dynamically configurable iptables rule sets, providing stateful packet inspection, port-level filtering, and traffic shaping. WireGuard's cryptographic tunnelling ensures all inter-node communications are protected using AES-256 encryption and SHA-256 hashing, mitigating MITM and eavesdropping attacks. The system incorporates RBAC, Two-Factor Authentication (2FA), and an IDS module monitoring live traffic for anomalous patterns.
Experimental results demonstrate SunduVault reduces unauthorised access attempts by over 85%, maintains sub-millisecond VPN handshake latency, and processes firewall rule updates within 200 milliseconds.
Keywords: WireGuard VPN · iptables · Hybrid Security · RBAC · 2FA · IDS · AES-256 · Real-Time Monitoring · Network Access Control
⚠ Problem
Organisations manage firewall rules, VPN configurations, user accounts, and monitoring systems as entirely separate concerns — each with its own interface, log format, and failure mode. This fragmentation creates configuration drift, delayed intrusion response, and audit gaps.
✓ Solution
SunduVault provides a single control plane that enforces consistent policy across all security layers — replacing manual CLI tools with an automated, web-based unified security management framework accessible to both administrators and end users.
Limitations of Existing Fragmented Systems
Software Requirements
Hardware Requirements
Stateful packet filtering enforcing deny-by-default policy. Permits only UDP 51820 (WireGuard), TCP 80/443 (HTTPS), SSH 22, ICMP, and established/related connections. All other inbound traffic is dropped.
All inter-peer traffic encrypted with ChaCha20-Poly1305 cipher and Curve25519 key exchange — preventing eavesdropping, MITM, and replay attacks with forward secrecy guarantees.
Short-lived JWT access tokens (15-minute expiry) with 7-day refresh token rotation. HMAC-SHA256 signature verification on every protected API endpoint. Automatic 401 interception with seamless token refresh.
RFC 6238 Time-based One-Time Password with 30-second window. Compatible with Google Authenticator, Authy, and standard TOTP apps. Stolen credentials alone are insufficient for access.
Two-tier role model: Administrator (full system control) and User (self-service device management only). NIST RBAC standard (INCITS 359-2004) compliant. Enforces principle of least privilege across all API endpoints.
JWT-based login flow with bcrypt password verification (cost factor 12), TOTP 2FA validation, and OAuth 2.0 token lifecycle management. Token validation on every protected endpoint via HMAC-SHA256 signature check.
Full peer CRUD via wg set CLI wrapper. Automated IP allocation, persistent config file updates with LOCK_EX concurrency control, and browser-side QR code provisioning using qrcode.js.
Dynamic iptables rule insertion and deletion via PHP shell_exec() with escapeshellarg() injection protection. MongoDB-backed rule persistence with atomic flush-and-rebuild strategy ensuring live kernel consistency.
CIDR-aware IPNetwork class with MongoDB-backed allocation bitmap. Sequential getNextIP() skipping network/gateway addresses. Cross-reference reconciliation on startup to resolve config drift between WireGuard interface and database.
Client-side polling at 5-second intervals via Fetch API. Per-peer traffic stats (received/transmitted bytes) with online classification — peers online if handshake within 3 minutes. Chart.js network throughput visualisation.
Hybrid IDS combining signature-based detection (port scans, SYN floods, ICMP floods) with threshold-based anomaly detection — auto-blocking source IPs exceeding 100 connection attempts/minute via dynamic iptables DROP rules.
Sample: WireGuard Peer Addition Flow
Authentication Endpoints
| Endpoint | Method | Auth |
|---|---|---|
| /auth/login | POST | None |
| /auth/refresh | POST | Refresh |
| /auth/signup | POST | Admin JWT |
| /auth/current | GET | Bearer JWT |
WireGuard Peer Endpoints
| Endpoint | Method | Auth |
|---|---|---|
| /wg/add_peer | POST | Bearer JWT |
| /wg/get_peer | GET | Bearer JWT |
| /wg/get_peers | GET | Bearer JWT |
| /wg/remove_peer | POST | Bearer JWT |
Standards & Protocols
RFC 7519
JWT Token Format
RFC 6749
OAuth 2.0 Auth Flow
RFC 6238
TOTP 2FA Standard
WireGuard Protocol
VPN Tunnelling & Key Exchange
NIST SP 800-53
Security Control Framework
NIST RBAC
INCITS 359-2004 Role Model
Unit Test Results — All 12 Cases Passed
| Test Case | Module | Expected | Result |
|---|---|---|---|
| TC-01: Valid Login | Auth | JWT tokens issued | PASS |
| TC-02: Invalid Password | Auth | 401 Unauthorized | PASS |
| TC-03: Expired Token | OAuth | 401, token refresh | PASS |
| TC-04: Add Peer | WireGuard | Peer added, IP allocated | PASS |
| TC-05: Duplicate Key | WireGuard | Error returned | PASS |
| TC-06: Remove Peer | WireGuard | Peer removed, IP freed | PASS |
| TC-07: IP Allocation | IPNetwork | Sequential IP returned | PASS |
| TC-08: Full Subnet | IPNetwork | Error: subnet full | PASS |
| TC-09: TOTP Valid | Auth | Login succeeds | PASS |
| TC-10: TOTP Invalid | Auth | 403 Forbidden | PASS |
| TC-11: RBAC User→Admin | Auth | 403 Forbidden | PASS |
| TC-12: Firewall Rule Add | Firewall | Rule active in iptables | PASS |
| Feature | SunduVault | pfSense | OpenVPN AS | WireGuard CLI |
|---|---|---|---|---|
| Unified Web UI | ✓ | ✓ | ✓ | ✗ |
| WireGuard Support | ✓ | Partial | ✗ | ✓ |
| RBAC | ✓ | ✓ | ✓ | ✗ |
| 2FA | ✓ | ✓ | ✓ | ✗ |
| REST API | ✓ | ✓ | ✓ | ✗ |
| QR Code Provisioning | ✓ | ✗ | ✗ | Manual |
| Cost | Free | Free/Paid | Paid | Free |
| Dedicated Hardware | Not Required | Required | Depends | Not Required |