How to Secure Your Java Applications with ja-netfilter: A Step‑by‑Step Guide

Many developers worry that open‑source projects may contain hidden backdoor code that could expose sensitive information. To address this, the open‑source Java firewall ja‑netfilter is introduced as a protective solution.

How to Add

First, download the ja‑netfilter.jar file (download link provided at the end of the original article). Add the following JVM argument: -javaagent:/absolute/path/to/ja-netfilter.jar Then edit your janf_config.txt file. The jar searches for the configuration file in the following order:

As a -javaagent parameter, e.g.

-javaagent:/absolute/path/to/ja-netfilter.jar=/home/neo/downloads/janf_config.txt

Environment variable JANF_CONFIG System property janf.config, e.g. java -Djanf.config="/home/neo/downloads/janf_config.txt" JVM options file line, e.g. -Djanf.config="/home/neo/downloads/janf_config.txt" Same directory as ja‑netfilter.jar (recommended for simplicity)

File .janf_config.txt in the user's home directory, e.g. /home/neo/.janf_config.txt File in .config subdirectory of the home directory, e.g. /home/neo/.config/janf_config.txt File in .local/etc subdirectory of the home directory, e.g. /home/neo/.local/etc/janf_config.txt File in /usr/local/etc, e.g. /usr/local/etc/janf_config.txt File in /etc, e.g. /etc/janf_config.txt After configuring, run your application as usual.

Configuration File Parameters

The janf_config.txt file uses sections such as [ABC], [URL], [DNS], etc., with comparison operators like EQUAL, KEYWORD, PREFIX, REGEXP, and so on. Example to block the common DBeaver license verification URL:

[URL]
PREFIX,https://dbeaver.com/lmp/checkLicense

Debugging

By default, ja‑netfilter does not output debug logs. To enable debugging, set the environment variable JANF_DEBUG=1 or add the system property -Djanf.debug=1 to the JVM arguments.

Summary

The project is built on the javaagent mechanism, making it compatible with any Java program. The author welcomes contributions and encourages developers to try this open‑source firewall.