v1.0 · linux/amd64 · linux/arm64

Programmable network gateway,in one daemon.

The Gateway runs your firewall, DNS, VPN tunnels, mesh, traffic splitter and kill-switch as one Go process — and exposes the whole stack through a single REST API and web UI. Built for Raspberry Pi 4 and Linux VPS.

One binary. Go + SQLite + nftables.Fail-closed. Ref-counted kill-switch.Self-healing. Minute-cadence reconciler.
root@gateway-01 ~ gwctl
$ gwctl observer
Overall: healthy

COMPONENT   STATUS  CHECKS  FAILS
dns         ok      1247    0
transport   ok      1247    0
firewall    ok      1247    0
mesh        ok      1247    0

$ gwctl evaluate laptop-alice | jq .
{
  "policy":      "alice-private",
  "profile":     "high-privacy",
  "action":      "pool",
  "endpoints":   ["wg-eu-01","wg-eu-02","wg-eu-03"],
  "fwmark":      "0x701-0x703",
  "fail_policy": "closed",
  "dns":         "gateway"
}

$ gwctl tunnels down wg-eu-02
Tunnel wg-eu-02 brought down
$ _
Built on
GoSQLitenftablesWireGuardHeadscaleReactOllama (optional)
Why operators pick it

Built for technical operators.

Not a one-click consumer VPN appliance. The Gateway gives you per-device routing, fail-closed guarantees, and one control plane for every kernel-level resource it touches.

One binary, one UI

Single Go daemon. SQLite for state. Integrated DNS resolver. No broker, no message queue, no Kubernetes.

Fail-closed by default

Reference-counted kill-switch. Per-policy. Daemon restart never opens a leak window. Drift re-applied every minute.

Per-device, per-domain

Route one laptop through one tunnel, send Telegram through a bridge, force IoT direct — all from one policy engine.

Privacy levels 0 → 5

Tune from performance to maximum: round-robin or crypto-random selection, packet padding, Poisson cover traffic, HTB bandwidth shaping.

Censorship-resistant

First-class bridges with SNI fronting and a static decoy site on the same hostname. TLS by default; obfs4 for DPI-heavy networks.

Federated by design

Peer multiple gateways over an existing mesh tunnel. Per-kind roles: primary, secondary, independent.

LaptopVLAN 10TabletVLAN 20Smart TVVLAN 30Mesh peertailscalenftables · kill-switch (ref-counted)prerouting · priority -1 · fail-closedPolicy engineper-device · per-domainDNS planeresolver · filter · zonesSplitting engine · privacy 0–5numgen round-robin · cover traffic · HTB shapingWireGuardwg-eu-01OpenVPNovpn-us-01BridgeSOCKS5 / TLSDirectWAN egress
How it works

Every plane of your network, in one process.

Devices enter through nftables. Policy decides which tunnel. The splitting engine spreads connections across exits. DNS is intercepted, filtered and rotated. A reconciler watches every kernel object and re-applies anything that drifts.

  • Kernel-fast dataplane. Slot selection is nftables numgen — no userspace per packet.
  • Self-healing. Drift events surface on the Reconciliation page, fixed on the next minute-cadence tick.
  • Auditable. Every config-changing API call is logged with operator and source IP.
Full architecture →
Capabilities

What's in the box.

Eleven subsystems. One coherent control plane.

Use cases

From a Pi in a backpack to a federated cluster.

Five concrete deployment shapes, each documented end to end — topology, policies, kill-switch behaviour and trade-offs.

Get started

From bare metal to your first kill-switch in ten minutes.

Three steps. None of them require touching nftables by hand.

01

Install

One installer script with five profiles (rpi, vps, node, full, custom). Creates the systemd unit, TLS cert, and SQLite store. Doesn't auto-start so you can review.

Install guide →
02

Add a tunnel + a device

Paste a WireGuard config from your provider. Register one device by MAC. Both from the web UI, the REST API, or gwctl.

Quick start →
03

Create a policy

Match the device, route through the tunnel, set fail_policy: closed. Test the kill-switch by bringing the tunnel down. Done.

Browse recipes →

Take it for a spin.

Install on a spare Pi or a $5/month VPS. The installer is profile-driven —rpi, vps, node, full, or custom — and brings up a TLS-fronted web UI on first boot.