Open-Source Firewalls

pfSense is an open-source operating system that turns a standard computer into a dedicated firewall and router with a web-based management interface. It runs on the FreeBSD kernel with the pf packet filter for stateful firewall and NAT processing, and manages all settings through a PHP-driven web interface that writes to XML configuration files. The platform provides a comprehensive set of network security capabilities accessible through its browser-based control panel. Users can configure packet filtering rules to control traffic flow between network segments, manage network address translat

This project is the core management framework for a security appliance, providing the primary infrastructure for firewall management, network intrusion prevention, and high-availability networking. It serves as the centralized system for controlling network security policies, filtering traffic, and administering a security appliance dashboard. The system is distinguished by its high-availability capabilities, which include synchronizing configurations and connection state tables across redundant nodes to enable automatic hardware failover. It also features a modular plugin architecture for ex

OpenWrt is a modular Linux distribution designed for resource-constrained networking hardware. It functions as a comprehensive network routing platform, providing a complete build environment that allows users to generate custom firmware images for a wide variety of embedded processor architectures. By utilizing a standardized cross-compilation toolchain and a package-based ecosystem, it enables the creation of tailored operating systems for specific hardware deployments. The project distinguishes itself through a hardware abstraction layer that normalizes interactions across diverse chipsets

Fail2ban is an intrusion prevention system that monitors system log files to detect malicious activity and automatically enforce security policies. By parsing log data in real time, the tool identifies patterns of unauthorized access or repeated authentication failures and responds by dynamically updating network access control lists to restrict offending sources. The software functions as a firewall automation tool that maintains stateful tracking of suspicious behavior across various network services. It utilizes a regex-driven pattern matching engine to identify specific attack signatures,

nps is an intranet penetration proxy server that exposes internal network services to the public internet via secure TCP and UDP tunnels. It functions as a traffic forwarder and reverse proxy, enabling external access to local services, remote desktops, and internal APIs. The project is distinguished by a centralized web-based administration interface used to configure tunnels, manage user accounts, and monitor real-time bandwidth metrics. It supports domain-based request routing and provides a mechanism to secure public services using HTTPS encryption through digital certificates. The syste

Security Onion is a security information and event management platform and network security monitoring suite. It functions as an intrusion detection system and a network traffic analysis tool designed to identify malicious activity and network intrusions through signature-based detection and host-based monitoring. The platform integrates a security case management system to organize investigations by tracking detections and grouping related security events. It provides capabilities for full packet capture, network metadata extraction, and the collection and indexing of security logs from dive

Augmented Traffic Control is a network condition simulator and Linux traffic control interface. It emulates latency, packet loss, and bandwidth limits to test how applications perform under various network qualities. The project provides a remote network shaping manager that allows users to apply and store network shaping profiles in a database for consistent simulation. This is accessible via a web-based management dashboard and a remote interface, removing the need for a local client installation. The system covers kernel-level traffic shaping to constrain outgoing traffic and includes dat

nDPI is a deep packet inspection toolkit and network protocol classifier designed to identify protocols and detect security threats through packet payload inspection. It functions as a network security monitor and a traffic analysis framework used to determine the services originating network flows. The system utilizes a modular dissector architecture and a sequence-based dissector chain to interpret network traffic. It supports custom protocol definition and protocol dissector extensions, allowing for the identification of proprietary or new network protocols. The toolkit provides capabilit

OpenEDR is an endpoint detection and response platform designed to collect telemetry and monitor system activity to identify security breaches. It functions as a host-based intrusion detection system and telemetry collector, gathering detailed data on process, network, and file activity. The system includes a dockerized security stack that bundles search, logging, and visualization tools into containers for analyzing endpoint telemetry. It features a security event visualizer that maps process lineage and indexes logs to facilitate root-cause analysis of attacks. The platform provides capabi

Keepalived is a high availability manager and virtual IP failover tool that ensures continuous service availability. It coordinates the migration of floating IP addresses between master and backup nodes using the Virtual Router Redundancy Protocol to manage router redundancy and seamless failover. The project distinguishes itself by integrating with the Linux kernel IPVS module to function as a transport-layer load balancer. It distributes network traffic across backend servers using various scheduling algorithms and forwarding methods such as NAT, direct routing, or tunneling. The system in

Comcast is a Linux network emulator and degradation tool used to simulate unstable or slow connections. It functions as a network impairment simulator that injects latency, packet loss, and bandwidth limits into network interfaces to verify how software handles adverse conditions. The utility serves as a TCP and UDP traffic shaper, allowing users to restrict bandwidth and filter traffic by destination address, protocol, and port. These capabilities enable the isolation of specific traffic streams to test application resilience when particular services are degraded. The tool provides broader

This project provides a containerized DNS sinkhole and network-wide traffic filtering solution. It functions as a central network resolver that intercepts domain queries, allowing users to block advertisements, trackers, and malicious domains by returning null responses to connected devices. The platform distinguishes itself through its integrated DHCP server and comprehensive management capabilities, which allow for automated IP address allocation and granular control over network traffic. It supports complex filtering through regular expression matching, hierarchical rule prioritization, an