Features overview

The Gateway is a stack, not a feature. Each subsystem owns a slice of the network and exposes it through the same REST API and the same UI. Pick a page below for the deep dive.

DNS planeRecursive resolver, per-device filtering, zones, rewrites, telemetry block.

VPN tunnelsWireGuard and OpenVPN with fwmark policy routing, health probes, auto-reconnect.

Traffic splittingRound-robin across exits with 6 privacy levels, cover traffic, per-policy isolation.

Bridge proxiesSOCKS5 → TLS / obfs4 relays for censored destinations.

Mesh networkingTailscale or self-hosted Headscale for inter-gateway connectivity.

Privacy & kill-switchReference-counted fail-closed firewall, IPv6/QUIC/WebRTC blocks, leak monitor.

Routing policiesPer-device, per-domain, per-interface steering with exceptions.

FederationPeer gateways with auto-provisioned WireGuard and shared config.

Alerts & monitoringAlert rules with webhook and Telegram dispatch.

AI assistantLocal Ollama assistant that proposes structured policy actions.

BackupAES-256-GCM export, scheduled SCP/SFTP push, selective restore.

Cross-cutting capabilities

Three things are not “features” — they’re properties of the whole system:

• Self-healing. Every kernel-level resource the daemon owns is watched by the reconciler. Drift is re-applied on the next minute-cadence tick (configurable down to 5 s). You don’t get to leak by accident.
• One control plane. The web UI, gwctl and the REST API all hit the same endpoints. Anything you can click you can script; anything in a screenshot is in the API.
• Stateful, not just configured. Tunnels know their handshake age. Bridges have cached latency. Devices have last-seen times. The reconciler uses this state to make decisions, not just to render UI.

Related

• Architecture — how the subsystems fit together at the kernel level.
• Concepts — the vocabulary used across feature pages.
• Use cases — concrete deployments that combine multiple features.