network firewall / security appliance

pfSense is an open-source operating system that turns a standard computer into a dedicated firewall and router with a web-based management interface. It runs on the FreeBSD kernel with the pf packet filter for stateful firewall and NAT processing, and manages all settings through a PHP-driven web interface that writes to XML configuration files. The platform provides a comprehensive set of network security capabilities accessible through its browser-based control panel. Users can configure packet filtering rules to control traffic flow between network segments, manage network address translat

OpenWrt is a modular Linux distribution designed for resource-constrained networking hardware. It functions as a comprehensive network routing platform, providing a complete build environment that allows users to generate custom firmware images for a wide variety of embedded processor architectures. By utilizing a standardized cross-compilation toolchain and a package-based ecosystem, it enables the creation of tailored operating systems for specific hardware deployments. The project distinguishes itself through a hardware abstraction layer that normalizes interactions across diverse chipsets

This project provides a complete OpenVPN server deployment packaged as a Docker container, with an integrated EasyRSA certificate authority for automated public-key infrastructure management. It handles the full lifecycle of a VPN server, from initial PKI bootstrap and server configuration generation to client certificate issuance and revocation, all within a containerized environment. The server is configured entirely through Docker environment variables, eliminating the need for manual configuration file editing. It supports time-based one-time password (TOTP) authentication as a second fac

Pritunl is an enterprise VPN gateway and server manager used to deploy and configure OpenVPN and WireGuard servers through a centralized web interface. It functions as a VPN access control system and an SSH certificate authority, issuing short-lived signed certificates to manage secure shell access and network entry without manual public key distribution. The platform acts as an SSO integrated VPN controller, synchronizing user access and organization mapping with third-party identity providers via OAuth, OIDC, and SAML. It supports high-availability deployments by using database-backed clust

Fail2ban is an intrusion prevention system that monitors system log files to detect malicious activity and automatically enforce security policies. By parsing log data in real time, the tool identifies patterns of unauthorized access or repeated authentication failures and responds by dynamically updating network access control lists to restrict offending sources. The software functions as a firewall automation tool that maintains stateful tracking of suspicious behavior across various network services. It utilizes a regex-driven pattern matching engine to identify specific attack signatures,

wireguard-ui is a web-based management interface and configuration generator for WireGuard VPN servers. It provides an authenticated administrative dashboard that allows users to manage VPN tunnels and peer connections through a graphical interface instead of manually editing configuration files. The project automates the creation of cryptographic key pairs and produces connection files and QR codes for distributing network settings to clients. It includes tools for tracking client metadata, such as names and email addresses, to identify individual users associated with specific connection se

PiVPN is an automated VPN deployer and server manager designed to establish secure gateways for remote network access. It provides a command-line tool for the installation and configuration of WireGuard and OpenVPN servers on Linux systems, with specific optimizations for single-board computers like the Raspberry Pi. The project distinguishes itself through a wrapper-based management interface that abstracts complex server commands into simplified operations. This includes automated handling of firewall rules, port forwarding, and package installation, as well as the ability to export client

dnscrypt-proxy is an anonymizing DNS proxy and encrypted DNS resolver. It acts as a local DNS forwarder that secures internet lookups by wrapping standard DNS queries in encrypted tunnels using the DNSCrypt and DNS-over-HTTPS protocols to prevent eavesdropping and tampering. The project provides network privacy protection by routing DNS requests through anonymized relays to obfuscate the client's original IP address. It further distinguishes itself through traffic management capabilities, such as mapping specific domains to designated resolvers and distributing queries across multiple servers

Firezone is a zero trust network access platform that uses WireGuard to provide identity-based connectivity to internal network resources. It functions as a virtual private network that synchronizes authentication and user groups via OpenID Connect providers. The system implements a group-based access control engine to enforce least privilege by restricting network resources to specific user groups. It utilizes holepunching and relay protocols for NAT traversal to establish encrypted tunnels through firewalls without requiring inbound ports. The platform includes a control plane for managing

V2ray-core is a modular network proxy engine designed to manage inbound and outbound traffic through a unified, rule-based processing pipeline. It functions as a background service that operates multiple concurrent network protocols within a single process, allowing for flexible traffic management and the independent handling of diverse communication streams. The project distinguishes itself through a highly decoupled architecture that treats network protocols as swappable modules, enabling the encapsulation of various transport layers into a consistent stream-based model. It features a centr

Algo is a cloud VPN deployment tool and WireGuard orchestrator designed to automate the provisioning and configuration of personal VPN servers across multiple cloud infrastructure providers. It functions as a multi-cloud infrastructure provisioner and a VPN client configuration generator, creating the necessary tunnels and connection profiles for secure device connectivity. The project distinguishes itself by integrating a network ad-blocking DNS server directly into the deployment, filtering advertisements and malicious domains for all connected clients. It further simplifies the onboarding

Nginx is a high-performance HTTP server and reverse proxy designed to handle high-concurrency traffic through an efficient, event-driven architecture. It functions as a versatile traffic management gateway and content delivery accelerator, providing the infrastructure necessary to route client requests, balance loads across backend servers, and serve static assets with minimal resource consumption. The project distinguishes itself through a master-worker process model that separates configuration management from request processing, ensuring stable operations under heavy load. Its modular requ