Skip to content
The Gateway

Introduction

The Gateway is a single Go daemon (gatewayd) plus a React control plane that runs every plane of your network from one place:

  • the firewall (nftables, atomic table replacement)
  • a recursive DNS resolver with per-device filtering and rewrites
  • WireGuard / OpenVPN tunnels with fwmark-based policy routing
  • a traffic-splitting engine with six configurable privacy levels
  • bridge proxies for censorship resistance (TLS by default, obfs4 for DPI-heavy networks)
  • a Tailscale or self-hosted Headscale mesh
  • per-device, per-domain routing policies with exceptions and TTLs
  • a reference-counted, fail-closed kill-switch
  • federation across multiple gateway nodes

It targets two deployment shapes:

  • Raspberry Pi 4 as a home / travel / small-office gateway with WiFi AP, DHCP, captive-portal detection and SD-card hardening.
  • Linux VPS (amd64 or arm64) as a remote node, a bridge, or a federation peer.

Who it’s for

Section titled “Who it’s for”

The Gateway is built for operators: people who already understand nftables, WireGuard and policy routing, and want a coherent control plane on top instead of a folder of bash scripts.

It is a good fit if you:

  • want per-device routing (e.g. “laptop through tunnel A, work phone through bridge B, IoT direct”)
  • need a fail-closed kill-switch that survives tunnel restarts without leaking
  • run multiple VPN exits and want to split connections across them
  • are deploying in censored environments and need pluggable transports
  • operate two or more gateways and want them to share state
  • prefer one binary, one SQLite file and one REST API over a microservice zoo

It is not a good fit if you:

  • want a one-click consumer VPN appliance
  • need Windows or macOS as a deployment target (Linux only)
  • want a fully open-source project (The Gateway is private / proprietary)

How the pieces fit

Section titled “How the pieces fit”
                      ┌─────────────────┐
   Web UI / API ─────►│   gatewayd      │
                      │  (Go daemon)    │
   gwctl CLI    ─────►│                 │
                      │  SQLite store   │
                      └────────┬────────┘
                               │
              ┌────────────────┼────────────────┐
              ▼                ▼                ▼
        nftables /       DNS plane         Transport
        iptables         (resolver +       (WG, OVPN,
        dataplane        filtering)        SOCKS5)
              │                                 │
              └──────────────┬──────────────────┘
                             ▼
                       Devices (LAN /
                       WiFi / Mesh)

The daemon owns every kernel-level resource it touches (nftables tables, ip rule, ip route, network namespaces). A reconciler scans this state once a minute (configurable, minimum 5 s) and re-applies anything that drifted, so a misbehaving sibling process or an out-of-band edit doesn’t silently break your policy.

Next steps

Section titled “Next steps”