Awesome GitHub RepositoriesFirewall Rule Configurations

Algo is a cloud VPN deployment tool and WireGuard orchestrator designed to automate the provisioning and configuration of personal VPN servers across multiple cloud infrastructure providers. It functions as a multi-cloud infrastructure provisioner and a VPN client configuration generator, creating the necessary tunnels and connection profiles for secure device connectivity. The project distinguishes itself by integrating a network ad-blocking DNS server directly into the deployment, filtering advertisements and malicious domains for all connected clients. It further simplifies the onboarding

Zapret is a deep packet inspection bypass tool and packet manipulation framework designed to circumvent network censorship. It operates as a transparent network proxy and TCP traffic obfuscator that modifies packets to deceive network inspection systems. The project distinguishes itself through advanced desynchronization strategies, including the modification of TLS client hello handshakes and the use of fake packet injection. It utilizes a combination of TCP stream segmentation, sequence overlapping, and TTL adjustment to hide prohibited requests from firewalls while ensuring the destination

OpenWrt-passwall is a network proxy management tool designed for OpenWrt firmware to facilitate internet censorship circumvention. It enables the routing of traffic through proxy servers or VPN tunnels to bypass network blocks and regional restrictions. The project integrates VPN client functionality directly into the router, allowing all connected devices to secure their traffic without individual software installations. It manages the configuration and switching of various proxy protocols and servers to control how local network traffic exits the gateway. The system utilizes a Lua-based we

Microsandbox is a runtime for creating and managing lightweight, hardware-isolated virtual machines — called sandboxes — that boot directly from standard OCI container images. Each sandbox runs as its own host process with a separate kernel, filesystem, and network stack, providing process-per-sandbox isolation. The project includes a command-line tool and multi-language SDKs (Rust, TypeScript, Python, Go) for programmatic lifecycle control, and it communicates with sandbox agents over Unix sockets using a CBOR-encoded protocol. What distinguishes Microsandbox is its combination of host-manag

pfSense is an open-source operating system that turns a standard computer into a dedicated firewall and router with a web-based management interface. It runs on the FreeBSD kernel with the pf packet filter for stateful firewall and NAT processing, and manages all settings through a PHP-driven web interface that writes to XML configuration files. The platform provides a comprehensive set of network security capabilities accessible through its browser-based control panel. Users can configure packet filtering rules to control traffic flow between network segments, manage network address translat

这是一个专为爱好者和家庭实验室环境设计的 Kubernetes 部署指南和基础设施配置工具。它提供了一个在各种云服务商及物理或虚拟节点上设置多节点集群的框架，充当自托管集群编排器。 该项目通过特定的实施指南专注于安全加固和基础设施稳定性。这包括涵盖主机防火墙和加密网络覆盖的网络安全框架，以及关于配置 Ingress 路由以通过 DNS 映射和流量控制器管理外部公共流量的详细说明。 其功能范围扩展到分布式存储配置，提供了实现复制块存储和持久卷的方法，确保容器重启后数据不丢失。它还涵盖了用于加密连接的自动化证书管理以及基于角色的访问控制配置。

LXD is a unified platform for managing both system containers and virtual machines through a single REST API and command-line interface. It provides a programmatic HTTP interface for controlling the full lifecycle of instances, enabling automation and integration with external tools. The system runs unprivileged containers with per-instance UID/GID mappings, seccomp filters, and AppArmor profiles for kernel-level isolation, while supporting multiple storage backends including directory, Btrfs, LVM, ZFS, Ceph, LINSTOR, and TrueNAS through a unified driver interface. The platform distinguishes

Webmin is a web-based administration interface for Unix systems. It provides a centralized console for managing the full range of server administration tasks — users and groups, software packages, storage, network configuration, system services, and security — all through a browser. Its modular architecture allows separate modules to handle databases (MySQL, MariaDB, PostgreSQL), web servers (Apache), DNS (BIND), email (Sendmail, Dovecot), file sharing (Samba, NFS), and more, with a unified access control system that restricts what each administrator can see and do. What sets Webmin apart is

Incus is a unified orchestration platform for managing system containers, OCI application containers, and virtual machines through a single control plane. It brings together cluster infrastructure management, secure multi-tenancy, software-defined networking, and pluggable storage backend orchestration into one cohesive system exposed via a full REST API and command-line interface. What distinguishes Incus is its ability to run multiple instance types side by side—full Linux system containers, OCI application containers, and QEMU virtual machines—all managed with consistent tooling. Networkin

该项目是安全设备的核心管理框架，为防火墙管理、网络入侵防御和高可用性网络提供主要基础设施。它作为控制网络安全策略、过滤流量和管理安全设备仪表板的集中式系统。 该系统以其高可用性功能而著称，包括在冗余节点之间同步配置和连接状态表，以实现自动硬件故障转移。它还具有用于扩展后端逻辑和用户界面的模块化插件架构，以及用于防火墙规则和系统设置程序化管理的基于 JSON 的 API。 该平台涵盖了广泛的功能领域，包括 IPv4 和 IPv6 的网络配置、安全 VPN 隧道、强制门户 (captive portal) 管理以及全面的监控和可观测性工具。它进一步集成了具有多因素身份验证的身份管理，并提供了用于配置备份、版本跟踪和跨 x86-64 硬件部署的工具。

本项目是一款审查绕过工具和透明代理网关，旨在绕过本地网络限制。它作为一个 SOCKS5 代理服务器、DNS 隧道工具和网络流量混淆器，帮助用户访问被封锁的网站。 该软件实现了掩码协议以隐藏数据的来源和目的地，从而规避限制性防火墙。它提供了网络流量混淆和安全 DNS 隧道功能，以保护网络隐私并解析被封锁的域名。 该系统通过防火墙规则和 IP 表转换拦截系统网络流量，处理大规模流量管理。它包括一个用于开发自定义代理插件的模块化架构，以定义专门的路由规则。

WireGuard Manager is a system orchestration tool designed to automate the deployment, configuration, and lifecycle management of virtual private network infrastructure. It functions by translating high-level user intent into precise, declarative system configurations, managing kernel-level network interfaces, and enforcing firewall-based traffic control to ensure secure, isolated network routing. The project distinguishes itself by providing a centralized web-based management interface that abstracts the complexity of manual configuration files. It includes comprehensive administrative tools